CVE-2022-0778

Deeper analysis

The vulnerability is an infinite loop in the BN_mod_sqrt() function within OpenSSL when it processes non-prime moduli during parsing of elliptic curve parameters in compressed form. This affects OpenSSL 1.0.2, 1.1.1, and 3.0 series, where the function is invoked while handling ASN.1-encoded explicit curve parameters or compressed public keys inside certificates and private keys. The flaw is tracked as CWE-835 and carries a CVSS 3.1 score of 7.5 with high impact on availability.

An unauthenticated attacker can supply a malicious certificate or private key containing invalid explicit curve parameters to any process that parses such structures before signature verification completes. This triggers a denial-of-service condition in TLS clients accepting server certificates, TLS servers accepting client certificates, certificate authorities processing requests, hosting providers ingesting customer material, or any other application using the affected function with attacker-controlled inputs. In OpenSSL 1.0.2 the loop is reached only on subsequent public-key operations, but a self-signed certificate suffices to activate it during verification.

Official fixes were released on 15 March 2022 in OpenSSL 1.1.1n, 3.0.2, and 1.0.2zd. Vendor advisories, including Siemens SSA-712929, direct users to upgrade to these patched versions or apply the corresponding backports; no workarounds are documented beyond disabling support for explicit curve parameters where feasible.

EPSS scores rose from a low baseline to a recorded peak of 0.1040, indicating measurable post-disclosure exploitation interest before receding to the current value of 0.0754. No widespread in-the-wild campaigns have been reported beyond proof-of-concept artifacts.