MNBSD-2023-3: Double free after calling PEM_read_bio_ex

Description

The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed.

Affected Versions

openssl

Specific versions:

• 2.0.0
• 2.0.1
• 2.0.2
• 2.1.0
• 2.1.1
• 2.2.0
• 2.2.1
• 2.2.2
• 2.2.3
• 2.2.4
• 2.2.5
• 2.2.6
• 2.2.7
• 2.2.8
• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 3.1.0
• 3.1.1

Recommendations

No specific recommendations provided.

References

• https://www.openssl.org/news/vulnerabilities.html#CVE-2022-4450
• https://github.com/MidnightBSD/src/commit/fae47427305375221e4e8d49f1027c53e8770430

Additional Information

Aliases: CVE-2022-4450

Published: April 03, 2023
Last Modified: April 03, 2023