This dangerous OpenSSL vulnerability can easily be triggered | CVE-2022-2274 Explained

Key Takeaways

a new security vulnerability was introduced in openssl version 3.0.4 titled heap memory corruption with rsa private key operation and this one is really scary right because you can trigger it trigger it really easily because if you have if your cypher suite happened to use an rsa signature just establishing a tls connection with the server right will trigger if the server have 3.0.4 they will have to use their private key to sign the message coming back from the tls server hello right and as a result that will cause the memory corruption that could also cause other possible remote code execution but what what really is nasty is the possible crash of the server i thought this is very interesting i wanted to discuss it let's jump into it so this comes from the open ssl security advisory back on july 5th 2022 heap memory corruption with rsa private key operations cve 2022 2022-2274 severity high and i think i know a lot of um these advisories are a little bit almost everything as high but i think this is and i am sometimes i describe some of them but this one is clearly a high you know especially if you have this particular cpu architecture you know let's jump into it the openness is a 3.0.4 release introduced a serious bug in the rsa implementation for x86 64 cpu supporting the avx 5512 ifma instructions i know this sounds confusing but it's going to be clear i did i didn't know what that was five minutes ago either so don't worry about it this issue makes the rsa implementation with 24 to 2048 bit private keys incorrect on such machines and memory corruption will happen during the computation as a consequence of the memory corruption an attacker may be able to trigger a remote code execution on the machine performing the computation or just crash the server i mean the moment you have memory corruption a crash might happen right if you have open ssl four that's that's the first condition right if you have one one one or other stuff 102 you're not affected at all if you have that you're good but if you have zero three zero four that's not enough you should have 304 and you should have a cpu that supports this complex instruction set system which is this avx-512 you might say what is that we're going to come and come and discuss that you see cryptography when you do cryptography and you do public key cryptography you use exponent shells and modulo algorithm all the time and doing this operation in the general purpose cpu you know using uh rest reduce instruction sets you know like using addition and normal multiplication this basic operation can be expensive so intel actually introduced a new uh cpu that supports a specific instruction which i think they call these cpus complex instructions at sisk right so they introduced a baked in instruction that does this complex stuff their rsa that does all of that stuff right you know multiplication modulo power exponents all this fancy stuff the security people look what open ssl 304 did is started consuming uh this instructions that if your cpu supports it that's what they did effectively in this particular issue that's what they did in this particular issue this is the issue where we found the bug but this is where we discovered it the work was let's support this particular cpu right because it's actually much faster to do this operation in a single cp in a single instruction in the cpu instead of doing it i don't know as a multiplication and an exponential and doing everything in sort of a normal multiple instructions make sense so openness started supporting that and they introduced a bug in the process she roya discovered the bug and uh gave a repro case and he says hey i have this particular cpu and this only happens when i have when i have this particular cpu this tells you that and you're a programmer you know that there are multiple code paths that takes place so why didn't this happen on normal cpus because it's a completely different code path in normal cpus we're going to use a completely different module that executes the normal code for exponents and modules right using uh simple instruction sets but open system when it detects there is a cpu of i keep forgetting the name ax v avx 5512 automatically shift into another path and that basically will execute the code and that code apparently it might have been missed to be tested with rsa with version with the bit size 2048 so just think guys how many possible permutation that we need to test on it's massive right so i don't blame the openssl team running into these bugs like every now and then and here's the effects you guys here's the fix that she actually installed the fix and the fix is really interesting because the fixes are just a division problem here where the factor size is was accidentally sent as in in number of bets where it should have been said in this special unit which open ssl uses bnu long and this bnu long is actually kep it depends on the on the word that is being used but it could be 16 32 or 64 bits in size so the fix here is just divide the number of bits by eight make them bytes and divide that number of bytes by the the size of this unit that the open ssl team uses which is bnu long and that gives you the number of bnu longs effectively and that's what you should use that was the bug right so very interesting a single line of code that fixes it right but it it tells you like how can you actually trigger this if you look closely you know in a traditional cipher suite here's an example of a cypher suite you know cypher suites at least in atl it's 1.2 for simplicity it consists of uh what four parts the first part is the key exchange algorithm so this is elliptic curve dfe helmet this is what we use to exchange the key the symmetric key and this is the symmetric key encryption algorithm so this is the guy right and the show the last one is the message digest authentication the message authentication code where we make sure that nobody actually tinkers with the message and this one is the second part which is the signature anything you send back the server uses this algorithm and uses its private key to sign the message that is sent so that when this when the client gets that message it uses the server public key to decrypt to verify the message that it belongs to so the moment you as a client as an attacker you send a tls request with this particular signature telling the server hey server i only support this signa this cipher suite the server will be forced to use this particular as assuming it supports it and it will use its private key and the moment it uses its private key it will go through this code path assuming the server is running on a cpu that supports ax 512 instruction cell that the the the complex instructions that does all this rsa stuff baked into the cpu then immediately you're going to get you're going to run into this problem the server will either crash the client which is the attacker can send a bulk of code that the server might actually accidentally execute causing a remote code execution obviously we didn't see any examples but that's basically the whole explanation of this basic this interesting but what do you guys think about this let me know if your thoughts below i'm gonna see you in the next one you guys stay awesome goodbye