CVE-2023-3446: OpenSSL DH Parameter Check DoS Vulnerability

CVE-2023-3446 Overview

CVE-2023-3446 is an Algorithmic Complexity Attack vulnerability in OpenSSL that affects the Diffie-Hellman (DH) key parameter validation functions. Applications using DH_check(), DH_check_ex(), or EVP_PKEY_param_check() to validate DH keys or parameters may experience significant delays when processing excessively long modulus values. When keys or parameters are obtained from an untrusted source, this vulnerability can be exploited to cause a Denial of Service condition.

The vulnerability exists because while OpenSSL typically refuses to use modulus values over 10,000 bits in length, the DH_check() function continues to perform additional checks using the oversized modulus value even after determining it is too large. This creates an opportunity for attackers to submit maliciously crafted DH parameters that consume excessive CPU resources.

Critical Impact

Applications accepting DH parameters from untrusted sources are vulnerable to Denial of Service attacks through excessive CPU consumption during parameter validation.

Affected Products

• OpenSSL 1.0.2
• OpenSSL 1.1.1
• OpenSSL 3.0.0
• OpenSSL 3.1.0
• OpenSSL 3.1.1

Discovery Timeline

• 2023-07-19 - CVE-2023-3446 published to NVD
• 2025-04-23 - Last updated in NVD database

Technical Details for CVE-2023-3446

Vulnerability Analysis

The vulnerability resides in OpenSSL's DH_check() function, which performs comprehensive validation of Diffie-Hellman parameters. One critical check confirms that the modulus ('p' parameter) does not exceed acceptable size limits—OpenSSL typically rejects modulus values over 10,000 bits. However, the function's design flaw allows subsequent validation steps to execute using the oversized modulus value, even after the size check has failed.

This creates an algorithmic complexity issue where an attacker can craft DH parameters with an extremely large modulus that triggers computationally expensive operations. The DH_check() function is also invoked by DH_check_ex() and EVP_PKEY_param_check(), extending the attack surface to applications using these APIs. Additionally, the dhparam and pkeyparam command line utilities are vulnerable when invoked with the -check option.

Importantly, the OpenSSL SSL/TLS implementation is not affected by this issue, and the OpenSSL 3.0 and 3.1 FIPS providers remain unaffected.

Root Cause

The root cause is an improper ordering of validation checks in the DH_check() function. While the function correctly identifies oversized modulus values, it fails to short-circuit remaining checks that depend on the modulus parameter. This allows computationally expensive operations to proceed with maliciously large values, violating the principle of fail-fast validation.

The weakness is classified under CWE-606 (Unchecked Input for Loop Condition) and CWE-1333 (Inefficient Regular Expression Complexity), both relating to resource consumption through uncontrolled algorithmic complexity.

Attack Vector

The attack requires network access to an application that accepts DH parameters from external sources and validates them using the affected OpenSSL functions. An attacker can exploit this by submitting crafted DH parameters containing an excessively large modulus value.

The attack mechanism involves constructing DH parameters where the 'p' (modulus) value exceeds normal bounds but remains syntactically valid. When these parameters are passed to DH_check(), the function attempts to perform primality testing and other computationally intensive operations on the oversized value, consuming CPU resources and potentially causing the application to become unresponsive.

Detection Methods for CVE-2023-3446

Indicators of Compromise

• Unusual CPU utilization spikes in processes handling cryptographic operations or TLS connections
• Application unresponsiveness or timeouts during DH parameter processing
• Log entries indicating excessive processing time for certificate or key validation operations
• Memory pressure from applications handling abnormally large cryptographic parameters

Detection Strategies

• Monitor process CPU utilization for applications using OpenSSL's DH validation functions
• Implement application-level logging to track DH parameter validation duration and flag anomalous processing times
• Deploy network intrusion detection rules to identify malformed or oversized DH parameters in TLS handshakes
• Review application logs for errors or timeouts related to DH_check(), DH_check_ex(), or EVP_PKEY_param_check() function calls

Monitoring Recommendations

• Configure resource monitoring alerts for sustained high CPU usage in web servers, VPN gateways, and other services performing DH key exchange
• Implement timeout thresholds for cryptographic parameter validation operations
• Monitor network traffic for unusual patterns in key exchange phases that may indicate exploitation attempts

How to Mitigate CVE-2023-3446

Immediate Actions Required

• Update OpenSSL to the latest patched version for your release branch immediately
• Audit applications to identify usage of DH_check(), DH_check_ex(), and EVP_PKEY_param_check() functions
• Review systems using the dhparam or pkeyparam command line tools with the -check option
• Implement input validation to reject DH parameters with excessively large modulus values before calling OpenSSL validation functions

Patch Information

OpenSSL has released security patches to address this vulnerability across multiple branches. The patches ensure that oversized modulus values are properly rejected before computationally expensive checks are performed.

Patched commits are available for review:

• OpenSSL Security Advisory July 2023
• OpenSSL Commit for 3.1 branch
• OpenSSL Commit for 3.0 branch
• OpenSSL Commit for 1.1.1 branch
• OpenSSL Commit for 1.0.2 branch

Linux distribution-specific advisories are available from Debian LTS, Gentoo GLSA-202402-08, and NetApp Security Advisory.

Workarounds

• Implement application-level size checks on DH parameters before passing them to OpenSSL validation functions
• Configure network-level filtering to reject abnormally large cryptographic parameters
• Consider switching to ECDH (Elliptic Curve Diffie-Hellman) where feasible, as it is not affected by this vulnerability
• Apply resource limits (ulimits, cgroups) to constrain CPU consumption by processes handling cryptographic operations

# Check OpenSSL version to verify patch status
openssl version -a

# Verify installed OpenSSL package version on Debian/Ubuntu
dpkg -l | grep openssl

# Verify installed OpenSSL package version on RHEL/CentOS
rpm -qa | grep openssl