CVE-2022-1473: Resource leakage when decoding certificates and keys
A memory leak flaw was found in OpenSSL, resulting in TLS servers and clients being halted by out-of-memory conditions, leading to a denial of service. An attacker needs to repeat actions continuously to trigger this vulnerability, resulting in a loss of application availability.
Other sources
The OPENSSLLHflush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be terminated by the operating system causing a denial of service. Also traversing the empty hash table entries will take increasingly more time. Typically such long lived processes might be TLS clients or TLS servers configured to accept client certificate authentication. The function was added in the OpenSSL 3.0 version thus older releases are not affected by the issue. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/openssl-srcto a version that resolves this vulnerability.Fixed in 300.0.6 - Upgrade
Upgrade
redhat/opensslto a version that resolves this vulnerability.Fixed in 1:3.0.1-41.el9_0 - Upgrade
Upgrade
debian/opensslto a version that resolves this vulnerability.Fixed in 1.1.1w-0+deb11u1Fixed in 1.1.1w-0+deb11u2Fixed in 3.0.15-1~deb12u1Fixed in 3.0.14-1~deb12u2Fixed in 3.5.0-1 - Upgrade
Upgrade
redhat/opensslto a version that resolves this vulnerability.Fixed in 3.0.3 - Upgrade
Upgrade
OpenSSLto a version that resolves this vulnerability.Fixed in 3.0.3 - Compensating control
Because Red Hat investigated and did not identify a practical mitigation for this issue, prioritize upgrading OpenSSL (no mitigation is specified in the provided text).
Event History
Frequently Asked Questions
What is CVE-2022-1473?
CVE-2022-1473 is a vulnerability in OpenSSL that causes TLS servers and clients to be halted due to a memory leak flaw.
What is the severity of CVE-2022-1473?
CVE-2022-1473 has a severity rating of 7.5, classified as high.
How does CVE-2022-1473 impact OpenSSL?
CVE-2022-1473 impacts OpenSSL by breaking the reuse of memory occupied by removed hash table entries, resulting in memory usage growth for long-lived processes decoding certificates or keys.
What is the remedy for CVE-2022-1473 in OpenSSL?
The remedy for CVE-2022-1473 in OpenSSL is to update to version 3.0.6 or later.
Where can I find more information about CVE-2022-1473?
You can find more information about CVE-2022-1473 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-1473), [OpenSSL Git Commit](https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=64c85430f95200b6b51fe9475bd5203f7c19daf1), [OpenSSL Security Advisory](https://www.openssl.org/news/secadv/20220503.txt).