RUSTSEC-2022-0025

Resource leakage when decoding certificates and keys

Reported

May 3, 2022

Issued

May 19, 2022 (last modified: June 13, 2023)

Package

openssl-src (crates.io)

Type

Vulnerability

Categories

denial-of-service

Aliases

References

https://www.openssl.org/news/secadv/20220503.txt

CVSS Score

7.5 HIGH

CVSS Details

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Patched

>=300.0.6

Unaffected

<300.0

Description

The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occupied by the removed hash table entries.

This function is used when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be terminated by the operating system causing a denial of service. Also traversing the empty hash table entries will take increasingly more time.

Typically such long lived processes might be TLS clients or TLS servers configured to accept client certificate authentication.

Advisory available under CC0-1.0 license.