OpenSSL CMS Key Unwrap Heap Out-of-Bounds Read

Compliance Impact

This vulnerability causes a heap buffer over-read that may lead to a denial of service (DoS) by crashing the application processing attacker-supplied CMS data. However, it does not result in information disclosure or unauthorized access to sensitive data.

Since there is no information disclosure or compromise of data confidentiality or integrity, the vulnerability does not directly impact compliance with data protection regulations such as GDPR or HIPAA, which primarily focus on protecting personal and sensitive information.

Nevertheless, the potential for denial of service could affect availability, which is a component of security standards. Organizations relying on vulnerable OpenSSL CMS decryption functions should consider this risk in their overall security posture and incident response planning.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability occurs during the processing of attacker-supplied CMS data using password-based decryption functions such as CMS_decrypt() or CMS_decrypt_set1_password() in OpenSSL. Detection involves monitoring or testing for attempts to decrypt CMS data with unusual or attacker-chosen stream-mode KEK ciphers that could trigger the heap out-of-bounds read.

Since the vulnerability is triggered by malformed CMS data and specific cipher selections, one practical detection method is to analyze CMS decryption attempts in logs or to fuzz test the CMS decryption functionality with crafted inputs that use stream-mode ciphers in the PWRI keyEncryptionAlgorithm.

There are no specific built-in commands mentioned in the provided context to detect this vulnerability directly on a network or system.

However, to check if your OpenSSL version is vulnerable, you can verify the OpenSSL version installed and whether it includes the fix for this issue (commits referenced in Resources 1-5). For example, run:

• openssl version

To test the vulnerability, you could attempt to decrypt CMS data with a crafted payload using the openssl cms command line tool with the -decrypt and -pwri_password options, but this requires creating malicious CMS data that triggers the issue, which is non-trivial and not provided here.

Useful 0 Not Useful 0

Executive Summary

This vulnerability occurs in the CMS password-based decryption process when handling attacker-supplied CMS data. Specifically, an attacker can choose a stream-mode KEK cipher that causes a heap out-of-bounds read in the function kek_unwrap_key().

The key unwrapping function reads 7 bytes from a heap allocation based on the wrapped key length. However, the cipher used is selected by the attacker without requiring it to be a block cipher. If a stream-mode cipher is chosen, the allocated buffer may be too small, leading to a buffer over-read.

This over-read happens during the unwrap attempt before any authentication, and no password knowledge is needed. Although the over-read is limited to a few bytes and does not disclose information, it can cause a crash if the buffer borders unmapped memory.

Useful 0 Not Useful 0

Impact Analysis

The primary impact of this vulnerability is a potential Denial of Service (DoS) condition. A heap buffer over-read may cause the application to crash if the input buffer ends at a memory page boundary and the following page is unmapped.

There is no information disclosure because the over-read bytes are not revealed to the attacker. However, the crash can disrupt the availability of the affected application.

Useful 0 Not Useful 0

Mitigation Strategies

Applications that call CMS_decrypt() or CMS_decrypt_set1_password() on untrusted CMS data are vulnerable to this issue.

Since the vulnerability is triggered by attacker-supplied CMS data using a stream-mode KEK cipher, immediate mitigation steps include avoiding processing untrusted CMS data with these functions.

Additionally, ensure that your OpenSSL version is updated once a fix is released, as the issue is related to the CMS password-based decryption implementation.

Useful 0 Not Useful 0