OpenSSL FFC-DH Peer Validation Uses Attacker-Supplied q Vulnerability

A vulnerability exists in OpenSSL's handling of Diffie-Hellman key exchange with DHX (X9.42) peer keys. When the function EVP_PKEY_derive_set_peer() is called, the peer key's subgroup membership is not properly validated. This flaw allows a malicious peer to present a key that can be used to recover the victim's private key after a few key exchange attempts. The vulnerability affects OpenSSL versions 4.0, 3.6, 3.5, 3.4, and 3.0.

Impact

Exploitation of this vulnerability allows a malicious peer to recover the victim's private key by taking advantage of the improper validation of the peer key's subgroup membership.

Reproduction

To reproduce this vulnerability, a malicious peer must present a DHX key that includes the victim's p and g parameters, a forged q value that is a small prime factor of the cofactor, and a public value Y of order r. The victim's private key can then be recovered after a small number of key exchange attempts.

Remediation

Users of OpenSSL 4.0 should upgrade to OpenSSL 4.0.1. Users of OpenSSL 3.6 should upgrade to OpenSSL 3.6.3. Users of OpenSSL 3.5 should upgrade to OpenSSL 3.5.7. Users of OpenSSL 3.4 should upgrade to OpenSSL 3.4.6. Users of OpenSSL 3.0 should upgrade to OpenSSL 3.0.21.