CVE-2022-0778: OpenSSL DoS Vulnerability

CVE-2022-0778 Overview

CVE-2022-0778 is an infinite loop vulnerability in OpenSSL's BN_mod_sqrt() function, which computes a modular square root. The bug causes the function to loop indefinitely when processing non-prime moduli, enabling attackers to trigger a denial of service condition. This function is internally used when parsing certificates containing elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form.

An attacker can exploit this vulnerability by crafting a certificate with invalid explicit curve parameters, causing any process that parses externally supplied certificates to become unresponsive. Since certificate parsing occurs before signature verification, systems are vulnerable even when processing untrusted certificates.

Critical Impact

Network-accessible services using OpenSSL for TLS can be rendered unavailable through maliciously crafted certificates, affecting TLS servers, TLS clients, certificate authorities, and hosting providers processing customer certificates.

Affected Products

• OpenSSL 1.0.2 through 1.0.2zc
• OpenSSL 1.1.1 through 1.1.1m
• OpenSSL 3.0.0 through 3.0.1
• Debian Linux 9.0, 10.0, 11.0
• NetApp Cloud Volumes ONTAP Mediator, Clustered Data ONTAP, StorageGRID
• Fedora 34, 36
• Tenable Nessus
• MariaDB
• Node.js

Discovery Timeline

• March 15, 2022 - CVE-2022-0778 published to NVD
• March 15, 2022 - OpenSSL releases security patches (versions 1.1.1n and 3.0.2)
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2022-0778

Vulnerability Analysis

The vulnerability resides in the BN_mod_sqrt() function within OpenSSL's big number (BN) library. This function is designed to compute the modular square root of a number, a mathematical operation essential for elliptic curve cryptography operations. The flaw manifests when the function receives a non-prime modulus as input, causing it to enter an infinite loop rather than returning an error or handling the edge case gracefully.

The impact is particularly severe because the vulnerable function is invoked during certificate parsing—a routine operation that occurs before any authentication or verification takes place. This means that merely receiving a malicious certificate is sufficient to trigger the denial of service, regardless of whether the certificate is valid or trusted.

Root Cause

The root cause is improper loop termination logic in the BN_mod_sqrt() function when handling non-prime moduli. The function's algorithm assumes it will eventually find a solution or determine no solution exists, but with carefully crafted non-prime moduli, the termination condition is never satisfied. This is classified as CWE-835 (Loop with Unreachable Exit Condition), also known as an infinite loop vulnerability.

Attack Vector

The attack can be delivered through multiple vectors, all involving the parsing of maliciously crafted cryptographic data:

TLS Client Attacks: A malicious server can send a crafted server certificate to TLS clients, causing the client application to hang indefinitely when parsing the certificate.

TLS Server Attacks: A malicious client can present a crafted client certificate during mutual TLS authentication, causing the server to become unresponsive.

Certificate Authority Attacks: Attackers can submit crafted Certificate Signing Requests (CSRs) to certificate authorities, potentially disrupting CA operations.

Self-Signed Certificate Attack: In OpenSSL 1.0.2, where public key parsing is deferred, attackers can use self-signed certificates to trigger the loop during signature verification.

The vulnerability can be triggered through any application using the BN_mod_sqrt() function where an attacker controls the parameter values, extending beyond certificate processing to any cryptographic operation utilizing this function.

Detection Methods for CVE-2022-0778

Indicators of Compromise

• Processes consuming 100% CPU indefinitely when handling TLS connections or certificate operations
• OpenSSL-dependent services becoming unresponsive without apparent cause
• Abnormal increase in connection timeouts from TLS-enabled services
• Log entries showing incomplete or stalled certificate parsing operations

Detection Strategies

• Monitor CPU utilization for OpenSSL-linked processes showing sustained high CPU without corresponding network activity
• Implement watchdog timers around certificate parsing operations to detect hung processes
• Deploy network intrusion detection rules to identify certificates with unusual elliptic curve parameters
• Use application performance monitoring to track TLS handshake durations for anomalies

Monitoring Recommendations

• Enable detailed logging for certificate processing operations to identify parsing delays
• Set up alerts for service availability degradation on TLS-enabled endpoints
• Monitor thread pool exhaustion in applications handling concurrent TLS connections
• Track connection queue depths for services accepting TLS connections

How to Mitigate CVE-2022-0778

Immediate Actions Required

• Upgrade OpenSSL to version 3.0.2, 1.1.1n, or 1.0.2zd immediately
• Restart all services linked against OpenSSL after upgrading the library
• Review and update all embedded systems and appliances that bundle OpenSSL
• Check dependent software (Node.js, MariaDB, Nessus) for vendor-specific patches

Patch Information

OpenSSL released patches on March 15, 2022. The fix adds proper validation of moduli in the BN_mod_sqrt() function to prevent infinite loops. Apply the following version upgrades based on your deployment:

Refer to the OpenSSL Security Advisory 20220315 for official patch information. Additional vendor-specific advisories are available from Debian Security Advisory DSA-5103, NetApp Security Advisory NTAP-20220321-0002, and Oracle Security Alerts.

Workarounds

• Implement network-level filtering to block certificates with suspicious elliptic curve parameters where feasible
• Configure process supervisors to automatically restart OpenSSL-dependent services that become unresponsive
• Implement connection timeouts and circuit breakers for TLS handshake operations
• Consider temporarily disabling elliptic curve cipher suites if patching cannot be performed immediately (note: this may significantly impact security and compatibility)

# Verify OpenSSL version to confirm patched status
openssl version -a

# Check if your OpenSSL is vulnerable (versions before 1.1.1n, 3.0.2, or 1.0.2zd are affected)
# Expected output for patched versions:
# OpenSSL 1.1.1n  15 Mar 2022
# OpenSSL 3.0.2   15 Mar 2022
# OpenSSL 1.0.2zd  15 Mar 2022