OpenSSL CMP: unchecked protectionAlg parameter type is dereferenced as a PBMParameter and crashes the process

Impact

When verifying password-based MAC protection on a CMP message, OpenSSL checks only that the protectionAlg parameter pointer is non-NULL, never its ASN.1 type, then casts it and treats it as a PBMParameter. A crafted message supplies a parameter of a different type and the invalid pointer is dereferenced. This happens before any MAC is computed, so the attacker does not need the PBM shared secret. It reaches CMP servers that accept PBM-protected messages via OSSL_CMP_SRV_process_request(), and CMP clients validating responses from a malicious or on-path server. The reliable consequence is a crash - no memory disclosure, no controlled write, no path to code execution. Narrow by construction: CMP is a specialised certificate-enrolment feature an application must explicitly enable, so this matters only if you run internal PKI enrolment infrastructure on OpenSSL's CMP support.

Who can reach it

For servers, any remote unauthenticated party that can send a CMP message to an endpoint accepting PBM-protected messages. For clients, a malicious or on-path CMP server. No shared secret needed either way.

What to do

Upgrade to the fixed OpenSSL release named in the 2026-08-25 advisory and restart your CMP server or client processes - typically a small set of PKI/enrolment hosts, not the whole fleet. If you do not enable CMP anywhere, no action is needed for this CVE beyond your normal OpenSSL update. The record does not name a fixed version for this CVE.

References

Related entries

• Linux kernel SCSI core: requeued commands never kicked, hanging device removal after host recoveryCVE-2026-64003 · Linux kernel SCSI core (scsi_run_host_queues device-state filter)High
• Linux kernel nvme-pci: dma_vec allocations leak on every peer-to-peer I/O completionCVE-2026-64020 · Linux kernel nvme-pci (dma_vec tracking for peer-to-peer DMA)High
• Linux kernel SMC-D client (CHID matching against unpopulated ism_dev slot): Slot 0 of the client's ISM device array isCVE-2026-64048 · Linux kernel SMC-D client (CHID matching against unpopulated ism_dev slot)High
• Linux kernel pcrypt: padata fallback leaves the parallel completion callback on the child requestCVE-2026-64312 · Linux kernel crypto pcrypt (padata -EBUSY fallback path)High
• Linux kernel RT scheduler: RT_PUSH_IPI can livelock a busy many-core node under softirq loadCVE-2026-64374 · Linux kernel RT scheduler (RT_PUSH_IPI pull logic on non-PREEMPT_RT kernels)High
• Linux kernel libceph: a monmap advertising zero monitors hits a BUG_ON and takes down the client nodeCVE-2026-68155 · Linux kernel libceph (ceph_monmap_decode, zero-monitor monmap)High