Strix
26.1K

CVE-2021-3711

CRITICALCVSS 9.8/10EPSS 87.82%

Last modified

CVE-2021-3711 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. EPSS estimates a 87.82% chance of exploitation in the next 30 days.

Description

In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k).

Metrics

CVSS 3.1
9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
87.82%

99.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
OpensslOpenssl>= 1.1.1, < 1.1.1l
DebianDebian Linux10.0
DebianDebian Linux11.0
NetappActive Iq Unified ManagerAll versions
NetappClustered Data OntapAll versions
NetappClustered Data Ontap Antivirus ConnectorAll versions
NetappE-Series Santricity Os Controller>= 11.0, <= 11.50.2
NetappHci Management NodeAll versions
NetappManageability Software Development KitAll versions
NetappOncommand InsightAll versions
NetappOncommand Workflow AutomationAll versions
NetappSantricity Smi-S ProviderAll versions
NetappSnapcenterAll versions
NetappSolidfireAll versions
NetappStorage EncryptionAll versions
OracleCommunications Cloud Native Core Security Edge Protection Proxy1.7.0
OracleCommunications Cloud Native Core Unified Data Repository1.15.0
OracleCommunications Session Border Controller8.4
OracleCommunications Session Border Controller9.0
OracleCommunications Unified Session Manager8.2.5
OracleCommunications Unified Session Manager8.4.5
OracleEnterprise Communications Broker3.2.0
OracleEnterprise Communications Broker3.3.0
OracleEnterprise Session Border Controller8.4
OracleEnterprise Session Border Controller9.0
OracleEssbase< 11.1.2.4.47
OracleEssbase>= 21.1, < 21.3
OracleHealth Sciences Inform Publisher6.2.1.1
OracleHealth Sciences Inform Publisher6.3.1.1
OracleJd Edwards Enterpriseone Tools< 9.2.6.3
OracleJd Edwards World Securitya9.4
OracleMysql Connectors<= 8.0.27
OracleMysql Enterprise Monitor<= 8.0.25
OracleMysql Server>= 5.7.0, <= 5.7.35
OracleMysql Server>= 8.0.0, <= 8.0.26
OraclePeoplesoft Enterprise Peopletools8.57
OraclePeoplesoft Enterprise Peopletools8.58
OraclePeoplesoft Enterprise Peopletools8.59
OracleZfs Storage Appliance Kit8.8
TenableNessus Network Monitor<= 5.13.1
TenableTenable.Sc>= 5.16.0, <= 5.19.1

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2021-3711?
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k).
How severe is CVE-2021-3711?
CVE-2021-3711 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 87.82% probability of exploitation in the next 30 days.
How do I fix CVE-2021-3711?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-3711?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST