Igor Ustinov

Generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations leaks information about the secret nonce through timing discrepancies. This occurs because curves without a dedicated constant-time implementation use BIGNUM operations that vary in execution time based on the value of the secret scalar. An attacker capable of measuring signing times across many signatures could potentially recover the private key using a lattice or Hidden Number Problem attack. This issue primarily affects applications using SM2 signing or ECDSA signing over Brainpool and other generic prime curves, particularly those whose group order lies on a machine-word boundary, such as brainpoolP384r1.

On ARM64 and RISC-V platforms, the SM2 curve utilizes a scalar multiplication implementation that is not constant-time. Because conditional branches and table lookups are determined by the bits of the secret scalar, the execution time and cache-access patterns depend on the long-term private key during decryption or the per-signature nonce during signature generation. This creates a timing and cache side-channel that allows an attacker to learn information about the secret scalar.

SM2 signature generation uses non-constant-time arithmetic on secret values, creating a timing side-channel. The process computes the signature value using variable-time BIGNUM operations on the private key and the secret nonce, meaning the time required to produce a signature depends on these secret values. An attacker capable of measuring signing times may obtain information about the per-signature secret nonce, which could lead to the recovery of the private key through a lattice or Hidden Number Problem attack.

A NULL pointer dereference can occur during the decryption of password-encrypted Cryptographic Message Syntax (CMS) messages. The issue arises because the OpenSSL CMS implementation dereferences the `PasswordRecipientInfo.keyDerivationAlgorithm` field without verifying its presence, despite it being defined as optional in the ASN.1 specification. An attacker can exploit this by providing a specially crafted CMS message, causing the application to crash and resulting in a Denial of Service.

A NULL pointer dereference can occur in a CMP client application when processing a crafted CMP response. An attacker controlling a CMP server or acting as a man-in-the-middle can send a CRMF CertRepMessage containing an EncryptedValue structure where the `symmAlg` field includes an algorithm OID but lacks a parameters field. This leads to an application crash and a Denial of Service. This issue affects applications that process untrusted CMP/CRMF messages.

A use-after-free condition occurs during PKCS#7 signature verification when processing a specially crafted PKCS#7 or S/MIME signed message. If the `SignedData` `digestAlgorithms` field is present as an empty ASN.1 SET, the `PKCS7 verify()` function may incorrectly free a BIO (Basic Input/Output abstraction) owned by the caller. A subsequent attempt by the application to use or free this BIO via `BIO free()` leads to memory corruption, process crashes, or potentially remote code execution. This issue affects applications using OpenSSL PKCS#7 APIs, while those using CMS APIs are not affected. FIPS modules in versions 4.0, 3.6, 3.5, 3.4, and 3.0 are not impacted as the affected code resides outside the FIPS module boundary.

Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32-bit platforms. This occurs when a crafted X.509 certificate contains an excessively large OCTET STRING value in extensions such as the Subject Key Identifier (SKID) or Authority Key Identifier (AKID). The system calculates the required buffer size by multiplying the input length by 3, which can overflow on 32-bit platforms, resulting in the allocation of an undersized buffer. This may lead to a crash, attacker-controlled code execution, or other undefined behavior. Applications and services that print or log contents of untrusted X.509 certificates are susceptible, although the certificates would need to exceed 1 Gigabyte in size.

Parsing CMS AuthEnvelopedData or EnvelopedData messages with maliciously crafted AEAD (Authenticated Encryption with Associated Data) parameters can trigger a stack buffer overflow. When processing CMS structures using AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying if its length fits the destination. This allows an attacker to provide a crafted CMS message with an oversized IV, causing a stack-based out-of-bounds write before any authentication or tag verification occurs. Applications and services parsing untrusted CMS or PKCS#7 content, such as S/MIME, are affected. Since the overflow occurs prior to authentication, no valid key material is required to trigger the issue, which may lead to a crash causing Denial of Service or potentially remote code execution.