CVE-2023-0286

Deeper analysis

CVE-2023-0286 is a type confusion vulnerability in X.509 certificate processing that affects OpenSSL and LibreSSL. It stems from incorrect ASN.1 handling of X.400 addresses within the GENERAL_NAME structure: the x400Address field is defined as ASN1_TYPE in the public header but is actually parsed as an ASN1_STRING, causing the GENERAL_NAME_cmp function to misinterpret the data when comparing names.

An attacker who can supply both a certificate chain and a CRL can exploit the flaw when an application enables CRL checking via the X509_V_FLAG_CRL_CHECK flag. By presenting a malicious X.400 address, the attacker can supply arbitrary pointers to an internal memcmp call, resulting in either disclosure of memory contents or a denial of service. The attack does not require valid signatures on the supplied chain or CRL in most cases, although it is primarily relevant to applications that implement their own network-based CRL retrieval rather than relying on local files.

Patches addressing the issue are available in OpenSSL (commits 2c6c9d439b, 2f7530077e, and fd2af07dc0) and LibreSSL 3.6.2, which correct the type definition and comparison logic for the affected field. The associated EPSS score has remained near its peak of 0.89 since disclosure.