Log in Start free

Vulnerability · Published Feb 8, 2023 · Assigned by openssl

CVE-2022-4450Double free after calling PEM_read_bio_ex

High 7.5

In plain English

A high-severity double free in OpenSSL from OpenSSL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 28.6% (higher than 98% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)28.6%top 1.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack. The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected. These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. These locations include the PEM_read_bio_TYPE() functions as well as the decoders introduced in OpenSSL 3.0. The OpenSSL asn1parse command line application is also impacted by this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8edk2-aarch6420220126gitbb1bba3d77-4.el8ALSA-2023:2932
AlmaLinux:9edk2-aarch6420221207gitfff6d81270b5-9.el9_2ALSA-2023:2165
AlmaLinux:8edk2-ovmf20220126gitbb1bba3d77-4.el8ALSA-2023:2932
AlmaLinux:9edk2-ovmf20221207gitfff6d81270b5-9.el9_2ALSA-2023:2165
AlmaLinux:9edk2-tools20221207gitfff6d81270b5-9.el9_2ALSA-2023:2165
AlmaLinux:9edk2-tools-doc20221207gitfff6d81270b5-9.el9_2ALSA-2023:2165
AlmaLinux:8openssl1:1.1.1k-9.el8_7ALSA-2023:1405
AlmaLinux:9openssl1:3.0.1-47.el9_1ALSA-2023:0946
AlmaLinux:8openssl-devel1:1.1.1k-9.el8_7ALSA-2023:1405
AlmaLinux:9openssl-devel1:3.0.1-47.el9_1ALSA-2023:0946
AlmaLinux:8openssl-libs1:1.1.1k-9.el8_7ALSA-2023:1405
AlmaLinux:9openssl-libs1:3.0.1-47.el9_1ALSA-2023:0946
AlmaLinux:8openssl-perl1:1.1.1k-9.el8_7ALSA-2023:1405
AlmaLinux:9openssl-perl1:3.0.1-47.el9_1ALSA-2023:0946
Alpine:v3.20openssl3.0.8-r0ALPINE-CVE-2022-4450
Alpine:v3.21openssl3.0.8-r0ALPINE-CVE-2022-4450
Alpine:v3.22openssl3.0.8-r0ALPINE-CVE-2022-4450
Alpine:v3.23openssl3.0.8-r0ALPINE-CVE-2022-4450
Alpine:v3.24openssl3.0.8-r0ALPINE-CVE-2022-4450
Debian:12openssl3.0.8-1DEBIAN-CVE-2022-4450
Debian:13openssl3.0.8-1DEBIAN-CVE-2022-4450
Debian:14openssl3.0.8-1DEBIAN-CVE-2022-4450
Rocky Linux:8openssl1:1.1.1k-9.el8_7RLSA-2023:1405
Rocky Linux:9openssl1:3.0.1-47.el9_1RLSA-2023:0946
Ubuntu:22.04:LTSedk22022.02-3ubuntu0.22.04.4USN-7894-1
Ubuntu:22.04:LTSedk22022.02-3ubuntu0.22.04.4UBUNTU-CVE-2022-4450
Ubuntu:24.04:LTSedk22024.02-2ubuntu0.6USN-7894-1
Ubuntu:22.04:LTSnodejs12.22.9~dfsg-1ubuntu3.3USN-6564-1
Ubuntu:22.04:LTSnodejs12.22.9~dfsg-1ubuntu3.3UBUNTU-CVE-2022-4450
Ubuntu:22.04:LTSopenssl3.0.2-0ubuntu1.8USN-5844-1
Ubuntu:22.04:LTSopenssl3.0.2-0ubuntu1.8UBUNTU-CVE-2022-4450

Affected products (as reported)

VendorProductVersions
OpenSSL OpenSSL 3.0.0 – before 3.0.81.1.1 – before 1.1.1t

Weakness: CWE-415 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References