OpenSSL Elliptic Curve Public Key Denial of Service



  A denial-of-service vulnerability has been reported in the OpenSSL library. The vulnerability is due to insufficient validation in BN_mod_sqrt() function.

  A remote attacker could exploit the vulnerability by sending crafted packets to an OpenSSL server or any application using OpenSSL libraries. Successful exploitation could result in denial of service conditions on the affected service.

  This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0.
    • Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1).
    • Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m).
    • Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc).

  Vendor Homepage

CVE Reference:

  This vulnerability has been assigned the Common Vulnerabilities and Exposures (CVE) identifier CVE-2022-0778.

  CVE Listing

Common Vulnerability Scoring System (CVSS):

  The overall CVSS score is 6.1 (AV:N/AC:L/Au:N/C:N/I:N/A:C/E:POC/RL:OF/RC:C).

  Base 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P):
    • Access vector is NETWORK
    • Access complexity is LOW
    • Level of authentication required is NONE
    • Impact of this vulnerability on data confidentiality is NONE
    • Impact of this vulnerability on data integrity is NONE
    • Impact of this vulnerability on data availability is COMPLETE
  Temporal 3.7 (E:POC/RL:OF/RC:C):
    • The exploitability level of this vulnerability is PROOF OF CONCEPT
    • The remediation level of this vulnerability is OFFICIAL FIX
    • The report confidence level of this vulnerability is CONFIRMED

  CVSS Calculator Metrics

Technical Overview:

  The vulnerability comes from BN_mod_sqrt() the interface function, which is used to calculate the modulo square root, and expects that the parameter p should be a prime number, but there is no check in the function, which may lead to an infinite loop inside. This function is used when parsing certificates in the following format:

  • When the certificate contains the elliptic curve public key in compressed format.
  • Certificates with explicit elliptic curve parameters whose base points are encoded in a compressed format.

  In short, this function is called when the point coordinates need to be decompressed when parsing the certificate. So the outside world can trigger an infinite loop by crafting a certificate with an illegal explicit curve parameter, causing a DoS attack.

Triggering the Problem:

  • Parsing certificates that contain elliptic curve public keys in compressed form.
  • Explicit elliptic curve parameters with a base point encoded in compressed form.
  • Crafting a certificate that has invalid explicit curve parameters.
  • Parsing crafted private keys as they can contain explicit elliptic curve parameters.

Triggering Conditions:

  • TLS clients consuming server certificates.
  • TLS servers consuming client certificates.
  • Hosting providers taking certificates or private keys from customers.
  • Certificate Authorities parsing certification requests from subscribers.
  • Anything else which parses ASN.1 elliptic curve parameters.
  • OpenSSL applications that use the BN_mod_sqrt() where you control the parameter values.

Attack Delivery:

  The following application protocols can be used to deliver an attack that exploits this vulnerability:
    • SSL/TLS, OpenSSL

SonicWall’s, (IPS) Intrusion Prevention System, provides protection against this threat:

  • IPS: 15407 OpenSSL BN_mod_sqrt Function DoS 1
  • IPS: 15491 OpenSSL BN_mod_sqrt Function DoS 2
  • IPS: 15351 OpenSSL BN_mod_sqrt Function DoS 3
  • IPS: 15755 OpenSSL BN_mod_sqrt Function DoS 4

Remediation Details:

  The risks posed by this vulnerability can be mitigated or eliminated by:
    • Apply the IPS signature above.
    • Apply the vendor-supplied patch that eliminates this vulnerability.
    • Remove write permissions for untrusted users.
  The vendor has released the following code changes regarding this vulnerability:
  Vendor Code Change

Security News
The SonicWall Capture Labs Threat Research Team gathers, analyzes and vets cross-vector threat information from the SonicWall Capture Threat network, consisting of global devices and resources, including more than 1 million security sensors in nearly 200 countries and territories. The research team identifies, analyzes, and mitigates critical vulnerabilities and malware daily through in-depth research, which drives protection for all SonicWall customers. In addition to safeguarding networks globally, the research team supports the larger threat intelligence community by releasing weekly deep technical analyses of the most critical threats to small businesses, providing critical knowledge that defenders need to protect their networks.