CVE-2022-2274
CRITICALOpenSSL 3.0.4 - Remote Code Execution via RSA AVX512IFMA Memory Corruption
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2022-2274. PoCs published by Malwareman007, DesmondSanctity, EkamSinghWalia.
AI-analyzed exploit summary This PoC demonstrates a vulnerability in OpenSSL by testing the SSL server handshake. It includes a certificate and RSA private key to simulate a server scenario, likely targeting a specific flaw in the handshake process.
Description
The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect on such machines and memory corruption will happen during the computation. As a consequence of the memory corruption an attacker may be able to trigger a remote code execution on the machine performing the computation. SSL/TLS servers or other servers using 2048 bit RSA private keys running on machines supporting AVX512IFMA instructions of the X86_64 architecture are affected by this issue.
Exploits (3)
This PoC demonstrates a vulnerability in OpenSSL by testing the SSL server handshake. It includes a certificate and RSA private key to simulate a server scenario, likely targeting a specific flaw in the handshake process.
This repository provides a detailed writeup of CVE-2022-2274, a heap memory corruption vulnerability in OpenSSL 3.0.4 affecting RSA private key operations on X86_64 CPUs with AVX512IFMA support. It includes technical details, reproduction steps, and references to patches.
This repository contains a simple shell script that checks the OpenSSL version to determine if the system is vulnerable to CVE-2022-2274. It does not exploit the vulnerability but merely scans for its presence.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H