CVE-2024-37305

Description

A flaw was found in oqs-provider, which is an OpenSSL 3 provider that contains post-quantum algorithms. The issue occurs from the way oqs-provider handles lengths decoded with DECODE_UINT32 at the start of serialized hybrid (traditional + post-quantum) keys and signatures. As a result, malformed input could potentially cause crashes or leak information.

Statement

This vulnerability is rated as IMPORTANT because of the flaw involves improper handling of lengths decoded with DECODE_UINT32 for hybrid keys and signatures, leading to unchecked memory reads and writes. This can cause crashes or leak sensitive information, posing a significant risk as it can be exploited remotely without any user interaction or privileges

Mitigation

It is recommended to update to the latest stable version to address this vulnerability.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score8.2N/AN/A
Attack VectorNetworkN/AN/A
Attack ComplexityLowN/AN/A
Privileges RequiredNoneN/AN/A
User InteractionNoneN/AN/A
ScopeUnchangedN/AN/A
ConfidentialityLowN/AN/A
Integrity ImpactNoneN/AN/A
Availability ImpactHighN/AN/A

Vector

Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Understanding the Weakness (CWE)

CWE-130

Confidentiality,Integrity

Technical Impact: Read Memory; Modify Memory; Varies by Context

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.