CVE-2022-2274

Description

The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect on such machines and memory corruption will happen during the computation. As a consequence of the memory corruption an attacker may be able to trigger a remote code execution on the machine performing the computation. SSL/TLS servers or other servers using 2048 bit RSA private keys running on machines supporting AVX512IFMA instructions of the X86_64 architecture are affected by this issue.

Weakness classification

• CWE-787: Out-of-bounds Write

Primary references

• openssl-security@openssl.org
• openssl-security@openssl.org — Exploit, Issue Tracking, Third Party Advisory
• openssl-security@openssl.org — Third Party Advisory
• openssl-security@openssl.org — Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Issue Tracking, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
• 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
• 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
• 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e