New OpenSSL infinite-loop bug could let attackers crash remote servers

OpenSSL maintainers have released patches to address a high-severity security flaw in the software library that could cause a denial of service (DoS) when parsing certificates.

Tracked as CVE-2022-0778 (CVSS score: 7.5), the issue arises when parsing a malformed certificate with invalid explicit elliptic-curve parameters, resulting in an infinite loop. The flaw is in a function called BN_mod_sqrt(), used to calculate the modular square root.

"Because certificate parsing occurs before verification of the certificate's signature, any process parsing an externally supplied certificate may be subject to a denial-of-service attack," OpenSSL said in an advisory published on 15 March 2022.

The infinite loop can also be triggered when parsing crafted private keys, since these may contain explicit elliptic-curve parameters.

Although there is no evidence that the vulnerability has been exploited, several scenarios could weaponise it: TLS clients or servers accessing a rogue certificate from a malicious server or client, or certificate authorities parsing certification requests from subscribers.

The vulnerability affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. The project addressed it with releases 1.0.2zd for premium-support customers, 1.1.1n and 3.0.2. OpenSSL 1.1.0 is also affected but will not receive a fix because it has reached end of life.

Google Project Zero security researcher Tavis Ormandy was credited with reporting the flaw on 24 February 2022. The fix was developed by Google's David Benjamin and OpenSSL's Tomáš Mráz.

CVE-2022-0778 is also the second OpenSSL vulnerability resolved since the start of the year. On 28 January 2022, maintainers fixed a medium-severity flaw, CVE-2021-4160 (CVSS score: 5.9), affecting the library's MIPS32 and MIPS64 squaring procedure.