Neil Horman

The OpenSSL QUIC stack contains a flaw in its automated peer detection mechanism used during the SSL handshake when utilizing an already connected socket. The process employs the `getpeername()` function with a buffer length that prevents the retrieval of larger addresses, such as IPv6. However, because the function returns the full address length and the system accepts this as the valid input buffer length, the address buffer may contain uninitialized stack data instead of the actual peer address. This results in the use of an invalid address for outgoing packets, causing connection loss and the disclosure of uninitialized stack data to passive network observers.

The OpenSSL QUIC server, when configured to skip address validation, incorrectly calculates the unvalidated credit limit. When processing a datagram containing multiple QUIC packets, the server adds the total length of the entire datagram to the credit limit for every individual packet contained within it. This behavior allows a remote attacker to spoof packets and trick the server into believing more data was received than actually occurred, violating the RFC 9000 amplification limit of three times the received data. Consequently, a remote attacker could leverage the server to amplify a Distributed Denial of Service (DDoS) attack.

When processing QUIC traffic, the QUIC stack may retain metadata for ACK-only packets for the entire duration of a connection if a peer repeatedly sends ack-eliciting packets without acknowledging the ACK-only responses. A remote peer that completes a QUIC handshake can exploit this by sending numerous PING frames to force the generation of ACK-only packets while withholding acknowledgments for ack-eliciting data. This behavior causes connection-scoped memory growth, which can lead to a Denial of Service through memory exhaustion, particularly during sustained traffic or across many concurrent QUIC connections.

The Certificate Management Protocol (CMP) caches additional certificates (`extraCerts`) sent in a CMP message but fails to remove them even if the message is rejected or the certificates are invalid. In scenarios where a server frequently reuses a single `OSSL CMP CTX` object for the duration of a process, this cache can grow without limits. A remote attacker can exploit this by repeatedly sending requests containing unique additional certificates designed to be rejected, forcing the server to store them indefinitely. This leads to unbounded memory growth and may result in Out-of-Memory (OOM) conditions, causing a Denial of Service.

Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers. This allows attackers to achieve key-equivalent functionality for a CMS recipient or bypass integrity validation for a message. In one scenario, an attacker can send a CMS message where the cipher is specified as a non-AEAD (Authenticated Encryption with Associated Data) cipher. If an attacker captures a legitimate AES-GCM AuthEnvelopedData message, they can rewrite the inner OID to AES-256-OFB (an unauthenticated keystream mode) with a chosen IV and ciphertext. If the application provides feedback on the success or failure of the decryption, it can act as an oracle to obtain key-equivalent functionality for the `CEK` (content-encryption key). Additionally, an attacker can reduce the tag length of an AEAD cipher to a single byte, enabling a brute-force attack to bypass integrity checks in applications relying on the `CMS decrypt()` function to reject modified content.

Name of the Vulnerable Software and Affected Versions OpenSSL versions 3.0 through 3.6 Description Processing a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo can lead to a NULL pointer dereference. This can cause applications that process attacker-controlled CMS data to crash before authentication or cryptographic operations, resulting in a Denial of Service. The issue occurs when the optional parameters field of KeyEncryptionAlgorithmIdentifier is examined without checking for its presence, leading to a NULL pointer dereference if the field is missing. Applications and services calling CMS decrypt() on untrusted input, such as S/MIME processing or CMS-based protocols, are affected. Recommendations Update to a version after 3.6. As a temporary workaround, avoid processing untrusted CMS EnvelopedData messages with KeyAgreeRecipientInfo.

Name of the Vulnerable Software and Affected Versions OpenSSL versions 3.0 through 3.6 Description Processing a specially crafted CMS EnvelopedData message with KeyTransportRecipientInfo can lead to a NULL pointer dereference. This can cause applications that process attacker-controlled CMS data to crash before authentication or cryptographic operations, resulting in a Denial of Service. The issue occurs when examining the optional parameters field of RSA-OAEP SourceFunc algorithm identifier without verifying its presence, leading to a NULL pointer dereference if the field is missing. Applications and services using CMS decrypt() on untrusted input, such as S/MIME processing or CMS-based protocols, are affected. Recommendations Update to a version after 3.6. Update to a version after 3.5. Update to a version after 3.4. Update to a version after 3.3. Update to a version after 3.0.

A heap-based out-of-bounds write can occur when writing large, newline-free data into a BIO chain utilizing the line-buffering filter, particularly when the subsequent BIO performs short writes. This memory corruption can lead to a denial of service. The line-buffering BIO filter (BIO f linebuffer) is not typically used in default TLS/SSL configurations. The issue is assessed as low severity due to the unlikely circumstances of attacker control and the filter's limited use with attacker-controlled data. The FIPS modules in versions 3.0, 3.3, 3.4, 3.5, and 3.6 are not affected as the BIO implementation is outside the FIPS module boundary.

The issue allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging improper access to a certain error field in the ext4 journal stop function.

A race condition in the `ip vs conn flush` function allows local users to cause a denial of service by exploiting a null dereference. This occurs when a connection timer expires while the connection table is being flushed before the appropriate lock is acquired, specifically on SMP systems.

The issue allows local users to cause a denial of service, resulting in a system crash, by utilizing crafted syscalls on the Itanium IA64 platform. This is related to certain "ptrace corner cases".