Vulnerability · Published Aug 31, 2022 · Assigned by mitre
CVE-2022-38152
High 7.5
In plain English
A high-severity security flaw in the wolfssl package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.9% (higher than 87% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An issue was discovered in wolfSSL before 5.5.0. When a TLS 1.3 client connects to a wolfSSL server and SSL_clear is called on its session, the server crashes with a segmentation fault. This occurs in the second session, which is created through TLS session resumption and reuses the initial struct WOLFSSL. If the server reuses the previous session structure (struct WOLFSSL) by calling wolfSSL_clear(WOLFSSL* ssl) on it, the next received Client Hello (that resumes the previous session) crashes the server. Note that this bug is only triggered when resuming sessions using TLS session resumption. Only servers that use wolfSSL_clear instead of the recommended SSL_free; SSL_new sequence are affected. Furthermore, wolfSSL_clear is part of wolfSSL's compatibility layer and is not enabled by default. It is not part of wolfSSL's native API.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | wolfssl | 5.5.0-r0 | ALPINE-CVE-2022-38152 |
| Alpine:v3.21 | wolfssl | 5.5.0-r0 | ALPINE-CVE-2022-38152 |
| Alpine:v3.22 | wolfssl | 5.5.0-r0 | ALPINE-CVE-2022-38152 |
| Alpine:v3.23 | wolfssl | 5.5.0-r0 | ALPINE-CVE-2022-38152 |
| Alpine:v3.24 | wolfssl | 5.5.0-r0 | ALPINE-CVE-2022-38152 |
| Debian:12 | wolfssl | 5.5.3-1 | DEBIAN-CVE-2022-38152 |
| Debian:13 | wolfssl | 5.5.3-1 | DEBIAN-CVE-2022-38152 |
| Ubuntu:22.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2022-38152 |
| Ubuntu:24.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2022-38152 |
| Ubuntu:25.10 | wolfssl | no fix listed | UBUNTU-CVE-2022-38152 |
| Ubuntu:26.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2022-38152 |
| Ubuntu:26.10 | wolfssl | no fix listed | UBUNTU-CVE-2022-38152 |
Affected products (as reported)
References
- https://github.com/wolfSSL/wolfssl/releases
- https://www.wolfssl.com/docs/security-vulnerabilities/
- https://github.com/wolfSSL/wolfssl/pull/5468
- https://github.com/tlspuffin/tlspuffin
- 20230119 wolfSSL before 5.5.0: Denial-of-service with session resumption mailing-list
- http://packetstormsecurity.com/files/170604/wolfSSL-Session-Resumption-Denial-Of-Service.html
- https://blog.trailofbits.com/2023/01/12/wolfssl-vulnerabilities-tlspuffin-fuzzing-ssh/