CVE-2022-3602 X.509 Email Address 4-byte Buffer Overflow

What is CVE-2022-3602?

CVE-2022-3602 is a high-severity memory corruption vulnerability in Fedoraproject Fedora, published on 1 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution. Many platforms implement stack overflow protections which would mitigate against the risk of remote code execution. The risk may be further mitigated based on stack layout for any given platform/compiler. Pre-announcements of CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6).

Weakness: CWE-787

Which versions are affected by CVE-2022-3602?

5 open source packages ship an affected version, including openssl-src, node and node-min. It affects 4 products.

Products include Fedoraproject Fedora, Netapp Clustered Data Ontap, Nodejs Node.js, Openssl Openssl.

How do I fix CVE-2022-3602?

Upgrade openssl-src to 300.0.11 or later.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2022-3602 being exploited?

There is no known exploitation of CVE-2022-3602 in the wild and no public exploit code.

Public exploit code: 8 proofs of concept on GitHub.

Other vulnerabilities in Fedoraproject Fedora

• CVE-2024-4577 PHP-CGI OS Command Injection Exploited Critical 9.8
• CVE-2021-39226 Grafana Authentication Bypass Exploited Critical 9.8
• CVE-2019-5544 VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Exploited Critical 9.8
• CVE-2024-4947 Google Chromium V8 Type Confusion Exploited Critical 9.6
• CVE-2024-4671 Google Chromium Visuals Use-After-Free Exploited Critical 9.6

All Fedoraproject Fedora vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2022-3602, BIT-node-2022-3602, BIT-node-min-2022-3602, CLEANSTART-2026-HF71338, CLEANSTART-2026-ZX41424, DEBIAN-CVE-2022-3602 and 4 more.