Executive Summary

This vulnerability is a stack buffer overflow in wolfSSL's PKCS7 implementation, specifically in the wc_PKCS7_DecryptOri() function. When processing a CMS EnvelopedData message that contains an OtherRecipientInfo (ORI) recipient, the function copies an ASN.1-parsed Object Identifier (OID) into a fixed-size 32-byte stack buffer without checking if the OID length exceeds this buffer size. If a crafted message contains an OID longer than 32 bytes, it causes a stack buffer overflow.

Exploitation requires that the wolfSSL library is built with the PKCS7 feature enabled (which is disabled by default) and that the application has registered an ORI decrypt callback.

Useful 0 Not Useful 0

Impact Analysis

The stack buffer overflow can lead to memory corruption, which may allow an attacker to execute arbitrary code, cause a denial of service (crash), or compromise the security of the affected system.

However, exploitation requires specific conditions: the library must be built with PKCS7 enabled and the application must have registered an ORI decrypt callback, which may limit the exposure.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that the wolfSSL library is not built with the --enable-pkcs7 option enabled, as this feature is disabled by default.

Additionally, avoid registering an ORI decrypt callback via wc_PKCS7_SetOriDecryptCb() in your application, since exploitation requires this callback to be registered.

Useful 0 Not Useful 0