Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVPPKEYderive, relying on OpenSSL to honor it. On OpenSSL 1.1.x, X25519, X448, DH and HKDF-extract ignore the incoming keylen, unconditionally writing the full shared secret (32/56/prime-size bytes). A caller passing a short slice gets a heap/stack overflow from safe code. OpenSSL 3.x providers do check, so this only impacts older OpenSSL.

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.0 to before 0.10.78, the frompemcallback APIs did not validate the length returned by the user's callback. A password callback that returns a value larger than the buffer it was given can cause some versions of OpenSSL to over-read this buffer. OpenSSL 3.x is not affected by this. This vulnerability is fixed in 0.10.78.

Summary aes::unwrapkey() has an incorrect bounds assertion on the out buffer size, which can lead to out-of-bounds write.

Details aes::unwrapkey() contains an incorrect assertion: it checks that out.len() + 8 <= in.len(), but this condition is reversed. The intended invariant is out.len() >= in.len() - 8, ensuring the output buffer is large enough.

Because of the inverted check, the function only accepts buffers at or below the minimum required size and rejects larger ones. If a smaller buffer is provided the function will write past the end of out by in.len() - 8 - out.len() bytes, causing an out-of-bounds write from a safe public function.

Impact Vulnerable applications using AES keywrap and allowing attacker controlled buffer sizes could have an attacker trigger an out-of-bounds write.

EVPDigestFinal() always writes EVPMDCTXsize(ctx) to the out buffer. If out is smaller than that, MdCtxRef::digestfinal() writes past its end, usually corrupting the stack. This is reachable from safe Rust.

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.24 to before 0.10.78, the FFI trampolines behind SslContextBuilder::setpskclientcallback, setpskservercallback, setcookiegeneratecb, and setstatelesscookiegeneratecb forwarded the user closure's returned usize directly to OpenSSL without checking it against the &mut [u8] that was handed to the closure. This can lead to buffer overflows and other unintended consequences. This vulnerability is fixed in 0.10.78.