CVE-2022-4450

/// Technical description

The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and

decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data.

If the function succeeds then the "name_out", "header" and "data" arguments are

populated with pointers to buffers containing the relevant decoded data. The

caller is responsible for freeing those buffers. It is possible to construct a

PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex()

will return a failure code but will populate the header argument with a pointer

to a buffer that has already been freed. If the caller also frees this buffer

then a double free will occur. This will most likely lead to a crash. This

could be exploited by an attacker who has the ability to supply malicious PEM

files for parsing to achieve a denial of service attack.

The functions PEM_read_bio() and PEM_read() are simple wrappers around

PEM_read_bio_ex() and therefore these functions are also directly affected.

These functio

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References