OpenSSL Heap Buffer Overflow Vulnerability in Hexadecimal Conversion

A heap buffer overflow vulnerability has been identified in OpenSSL versions 3.6, 3.5, 3.4, 3.3, and 3.0. This issue arises when an excessively large OCTET STRING value is converted to a hexadecimal string, leading to a potential crash or, in some cases, execution of attacker-controlled code. The vulnerability is specific to 32-bit platforms.

Impact

Exploitation of this vulnerability can cause a heap buffer overflow, which may lead to a crash or potentially allow for execution of attacker-controlled code.

Reproduction

To reproduce this vulnerability, supply a crafted X.509 certificate containing an excessively large OCTET STRING value in extensions such as the Subject Key Identifier or Authority Key Identifier. When these extensions are converted to hexadecimal, the size of the buffer required for the conversion is calculated based on the input length. On 32-bit platforms, this calculation can overflow, resulting in a heap buffer overflow.

Remediation

Users of OpenSSL 3.6 should upgrade to OpenSSL 3.6.2, those on OpenSSL 3.5 should upgrade to OpenSSL 3.5.6, users on OpenSSL 3.4 should upgrade to OpenSSL 3.4.5, and users on OpenSSL 3.3 should upgrade to OpenSSL 3.3.7.