OpenSSL: SM2 decryption understates the required buffer, overflowing it by up to 62 bytes

Impact

The SM2 decryption path reports a plaintext buffer size smaller than what the second EVP_PKEY_decrypt() call actually writes, so an application that follows the documented two-call pattern overflows its own buffer - usually on the heap - by up to 62 attacker-chosen bytes. Consequences range from corrupting adjacent application state to a crash, and the precise effect depends on the calling program. The practical caveat for a fleet is that only code paths that decrypt SM2 content from an untrusted party are reachable; most Western datacenter deployments never exercise SM2, so for them this is a library version to roll forward rather than an exposed path. Fixed in OpenSSL 1.1.1l; 1.1.1 through 1.1.1k are affected.

Who can reach it

An attacker who can present SM2-encrypted content to an application that calls EVP_PKEY_decrypt() on it with a caller-sized buffer. Reachability depends entirely on whether the service accepts SM2 input; authentication requirements are whatever the calling service imposes.

What to do

Update the distribution OpenSSL package to 1.1.1l or the vendor backport, then restart every service linked against the shared library - in practice a rolling daemon restart across the fleet, or a reboot if you would rather not chase every long-lived process. Statically linked appliances and vendor stacks (Siemens and NetApp advisories are in the record) need their own vendor update. No action is needed for images already on OpenSSL 3.x or 1.1.1l+.

References

Related entries

• Linux kernel mlx5_core kTLS RX offload: TLS RX resync list corruption: entries are moved by the resync handlerCVE-2021-47215 · Linux kernel mlx5_core kTLS RX offloadCritical
• Linux kernel (drivers/nvme/host): The NVMe/RDMA initiator destroys the queue pair before the connection manager ID, soCVE-2021-47378 · Linux kernel (drivers/nvme/host)Critical
• Linux kernel (net/tls): KTLS stored a negative errno into the socket error field where a positive value is expected. ACVE-2021-47496 · Linux kernel (net/tls)Critical
• Linux kernel (net/smc): The early link-group cleanup path deletes the list head instead of the link group, so the groupCVE-2021-47536 · Linux kernel (net/smc)Critical
• OpenSSL 3.0.4: memory corruption in 2048-bit RSA private-key operations on AVX512IFMA CPUsCVE-2022-2274 · OpenSSL 3.0.4 RSA implementation (AVX512IFMA path on x86_64)Critical
• glibc: stack buffer overflows in the deprecated sunrpc svcunix_create and clnt_create helpersCVE-2022-23218 · glibc sunrpc compatibility functions (svcunix_create, clnt_create)Critical