• Home
  • |
  • Blog
  • |
  • How to Fix CVE-2022-3602 and CVE-2022-3786- The Two New Buffer Overflow Vulnerabilities in OpenSSL
How To Fix CVE-2022-3602 and CVE-2022-3786- The Two New Buffer Overflow Vulnerabilities in OpenSSL

On 1st November, OpenSSL published an advisory that talks about two high-severity vulnerabilities in its software library. The vulnerabilities in OpenSSL allow attackers to carry out buffer overflow attacks on the system, which let OpenSSL crash that may eventually create a denial of service-like condition on the victim machine running the vulnerable version of OpenSSL or could allow attackers to carry out remote code execution on the machine on which vulnerable versions of OpenSSL are installed. Both the flaws have been tracking with the CVE IDs CVE-2022-3602 and CVE-2022-3786 are steamed from the ossl_punycode_decode function, a function that provides decoding functionality of Punycode domain names, have gotten the CVSS score of 7.5, which is considered High severity on the CVSSv3 scale. Since these flaws allow attackers to crash the OpenSSL and create a Denial of Service like condition and perform remote code execution on the machines running vulnerable OpenSSL releases, it is highly important to know how to fix CVE-2022-3602 and CVE-2022-3786, the two new buffer overflow vulnerabilities in OpenSSL.

There are a few aspects you should understand before we jump in to know how to fix CVE-2022-3602 and CVE-2022-3786, the two new buffer overflow vulnerabilities in OpenSSL. Let’s see about OpenSSL, Punycode, the role of Punycode decode function in OpenSSL, a summary of the vulnerabilities, few technical details about the version prone to the vulnerabilities in this post.

A short note about OpenSSL

OpenSSL is a software library that provides an open-source implementation of the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols. It is a general-purpose cryptography library that provides a wide range of security-related features, including support for SSL/TLS, cryptographic hashing, and digital signatures. It also includes a number of utility programs that can be used to generate keys, create and verify digital signatures, and encrypt and decrypt files.

OpenSSL is available for a wide variety of platforms, including Linux, Windows, and macOS. It can be used with a wide variety of programming languages, including C, C++, Java, and Python. The library is licensed under Apache License 2.0. This means that it is free to use for both commercial and non-commercial purposes. If you are looking for a robust and versatile SSL/TLS library, then OpenSSL is definitely worth considering.

If we talk about its establishment, OpenSSL was originally developed by Eric A. Young and Tim J. Hudson in the early 1990s and managed by a worldwide community of volunteers who contribute their time and expertise to produce the highest quality software possible.

A short note about Punycode

Punycode is a special encoding used to represent Unicode characters in ASCII. It is often used for internationalized domain names (IDNs). It is a very efficient encoding and can represent any Unicode character in just a few ASCII characters. If you need to represent Unicode characters in an ASCII-compatible way, then Punycode is definitely the way to go.

The Role of Punycode Decode Function in OpenSSL

OpenSSL uses ossl_punycode_decode function to convert the Punycode domain to Unicode. When there is a need to validate a client or server is configured to validate an X.509 certificate, OpenSSL invokes ossl_punycode_decode function, which takes a string buffer of a Punycode domain and converts it to Unicode for further processing.

Summary of CVE-2022-3602 and CVE-2022-3786:

Both are new buffer overflow vulnerabilities in OpenSSL which can be triggered during X.509 certificate verification. The flaw persists in the implementation of ossl_punycode_decode function in OpenSSL used to convert Punycode domain to Unicode during the validation of an X.509 certificate. The flaw allows remote attackers to execute arbitrary code on the machine running the vulnerable version of OpenSSL just by using a malicious TSL certificate. The only thing it requires to exploit is a malicious TLS certificate signed by a trusted CA.

The flaws affect both Clients and Servers. However, we could say that the flaws primarily affect Clients then Servers since the certificate verification is typically done on the client side. As we said, these two new buffer overflow vulnerabilities in OpenSSL could also be used to exploit the TLS servers through TLS Client Authentication.

Source: Datadog

Since certificate verification is typically done on the client side, this vulnerability primarily affects clients not servers. There is a case where servers could be exploited via TLS Client Authentication, which may bypass the CA signing requirements as client certs are usually not required to be signed by a trusted CA. Since client authentication is rare ,and most servers do not have it enabled, server exploitation should be low risk.


– Malwaretech

An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the `.’ character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.

– Viktor Dukhovni.

These flaws allows attackers to exploit the victim just by directing client to a malicious TLS server which uses a specially crafted certificate.

CVSS Break Up of CVE-2022-3602:

Associated CVE IDCVE-2022-3602
DescriptionA Buffer Overflow Vulnerabilities in OpenSSL
Associated ZDI ID
CVSS Score7.5 High
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Impact Score3.6
Exploitability Score3.9
Attack Vector (AV)Network
Attack Complexity (AC)Low
Privilege Required (PR)None
User Interaction (UI)None
ScopeUnchanged
Confidentiality (C)None
Integrity (I)None
availability (a)High

CVSS Break Up of CVE-2022-3786:

Associated CVE IDCVE-2022-3786
DescriptionA Buffer Overflow Vulnerabilities in OpenSSL
Associated ZDI ID
CVSS Score7.5 High
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Impact Score3.6
Exploitability Score3.9
Attack Vector (AV)Network
Attack Complexity (AC)Low
Privilege Required (PR)None
User Interaction (UI)None
ScopeUnchanged
Confidentiality (C)None
Integrity (I)None
availability (a)High

OpenSSL Versions Vulnerable To CVE-2022-3602 and CVE-2022-3786:

Both the vulnerabilities CVE-2022-3602 and CVE-2022-3786 affect only OpenSSL v3.x, that is, version from 3.0.0 to 3.0.6. OpenSSL v1.x are safe. Users of v1.x are not needed to take any actions against these two new buffer overflow vulnerabilities in OpenSSL.

All the standard Linux distributions such as CentOS, Fedora, Kali, Linux Mint, openSUSE Leap, and Ubuntu, docker images, macOS, and Windows operating systems which are running the vulnerable versions of OpenSSL are prone to the vulnerabilities and need to fix CVE-2022-3602 and CVE-2022-3786 vulnerabilities on them.

Affected Versions:

  • OpenSSL 3.0.0
  • OpenSSL 3.0.1
  • OpenSSL 3.0.2
  • OpenSSL 3.0.3
  • OpenSSL 3.0.4
  • OpenSSL 3.0.5
  • OpenSSL 3.0.6

Not Affected Versions:

  • OpenSSL 1.1.1
  • OpenSSL 1.1.0
  • OpenSSL 1.0.2
  • OpenSSL 1.0.1
  • LibreSSL

How to Check OpenSSL Version?

We recommend checking the version of OpenSSL on your servers and fix these two new buffer overflow vulnerabilities in OpenSSL as soon as possible. You can run this simple command to check the OpenSSL version on your machine.

$ openssl versio

If you are working in a large organization where you need to check the OpenSSL version on a large number of servers. MalwareTech has published a Bash and a PowerShell script to scan the OpenSSL version on Linux and Windows operating systems.

Linux scanner (Bash Script): https://github.com/MalwareTech/SpookySSLTools/blob/main/openssl_scan.sh

Windows scanner (PowerShell): https://github.com/MalwareTech/SpookySSLTools/blob/main/openssl_scan.ps1

How To Fix CVE-2022-3602 and CVE-2022-3786- The Two New Buffer Overflow Vulnerabilities in OpenSSL?

OpenSSL addresses both the vulnerabilities in its new releases. OpenSSL has rolled out the patched with the release of v3.0.7. All the users of vulnerable OpenSSL are suggested to find out the current version of OpenSSL on their machines and upgrade to v3.0.7 as suggested by the Vendor.

Patched OpenSSL Version:

  • OpenSSL 3.0.7

Time needed: 15 minutes.

How To Fix CVE-2022-3602 and CVE-2022-3786?

  1. Check the OpenSSL version

    Run this command to check the version of OpenSSL:

    $ openssl versionCommand to Check OpenSSL Version (1)

  2. Download the latest OpenSSL package

    Download the most recent package from OpenSSL. In this case, since we have OpenSSL v3.0.5, we need to download v3.0.7.

    Note: OpenSSL doesn’t offer build packages. You should download the source code of the most recent version, extract it, and build on your own. 


    $ cd Downloads/

    $ wget https://www.openssl.org/source/openssl-3.0.7.tar.gz

    $ chmod +x openssl-3.0.7.tar.gzDownload the OpenSSL 3.0.7 package

  3. Extract the OpenSSL package

    Extract the downloaded package to a folder.

    $ tar -zxf openssl-3.0.7.tar.gz

    $ cd openssl-3.0.7/Extract the OpenSSL package to a directory

  4. Manually compile OpenSSL 3.0.7

    Run this command to compile and create configdata.pm and makefile.


    $ ./configManually compile OpenSSL 3.0.7

  5. Install/upgrade OpenSSL 3.0.7

    Before you install the new OpenSSL, you should ensure you have ‘make’ and ‘gcc’ utilities installed on your machine. You may need to install make and gcc utilities before you install or upgrade the OpenSSL. Run this command to install the required packages if not preinstalled.

    $ sudo apt install make gcc

    Issue these commands to install or upgrade the OpenSSL.

    $ sudo make

    $ sudo make test

    $ sudo mv /usr/bin/openssl ~/tmp (Backup current openssl binary)

    $ sudo make install

    $ sudo ldconfig /usr/local/lib64/Install or upgrade OpenSSL 3.0.7

  6. Create symbolic link from newly install binary to the default location

    $ sudo ln -s /usr/local/bin/openssl /usr/bin/opensslCreate symbolic link from newly install binary to the default location

  7. Update the symbolic links in Ubuntu

    Run these commands to update symbolic links and rebuild the library cache:

    $ sudo ldconfigUpdate the symbolic links in Ubuntu

  8. Check the OpenSSL version once again after the patch

    Check the version of OpenSSL:


    $ openssl versionCheck the OpenSSL version once again after the patch

How To Fix The OpenSSL Error Loading Shared Libraries?

Some people would get an error in loading shared libraries. If you are one among those with such bad luck, if you see this error “openssl: error while loading shared libraries: libssl.so.3: cannot open shared object file: No such file or directory“, then this section is for you.

  1. Edit ld.conf file to add a line containing /usr/local/lib64
$ sudo nano /etc/ld.so.conf.d/lib.conf
/usr/local/lib64

OR

2. Sometimes, openssl is installed at /usr/local/ssl. Create a file and add a line containing /usr/local/ssl/lib64

$ sudo nano /etc/ld.so.conf.d/openssl.conf
/usr/local/ssl/lib64

Update the library paths upon adding the path to the file

$ sudo ldconfig

Check the OpenSSL version.

$ openssl version
OpenSSL 3.0.7 1 Nov 2022 (Library: OpenSSL 3.0.7 1 Nov 2022)

We hope this post will help you know how to fix CVE-2022-3602 and CVE-2022-3786, the two new buffer overflow vulnerabilities in OpenSSL. Please share this post and help to secure the digital world. Visit our social media page on FacebookLinkedInTwitterTelegramTumblr, & Medium and subscribe to receive updates like this. 

About the author

Arun KL

Hi All, I am Arun KL, an IT Security Professional. Founder of “thesecmaster.com”. Enthusiast, Security Blogger, Technical Writer, Editor, Author at TheSecMaster. To know more about me. Follow me on LinkedIn

Leave a Reply

Your email address will not be published. Required fields are marked

{"email":"Email address invalid","url":"Website address invalid","required":"Required field missing"}

Learn Something New with Free Email subscription

Email is also one of the ways to be in touch with us. Our free subscription plan offers you to receive post updates straight to your inbox.