CVE-2023-0215

一、漏洞信息
 漏洞编号：[CVE-2023-0215](https://nvd.nist.gov/vuln/detail/CVE-2023-0215)
 漏洞归属组件：[nodejs](https://gitee.com/src-openeuler/nodejs)
 漏洞归属的版本：10.11.0,10.21.0,12.18.4,12.22.11,16.14.2
 CVSS V3.0分值：
  BaseScore：7.5 High
  Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications. The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash. This scenario occurs directly in the internal function B64_write_ASN1() which may cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on the BIO. This internal function is in turn called by the public API functions PEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream, SMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7. Other public API functions that may be impacted by this include i2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and i2d_PKCS7_bio_stream. The OpenSSL cms and smime command line applications are similarly affected.
 漏洞公开时间：2023-02-08 00:00
 漏洞创建时间：2023-02-08 04:06:45
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2023-0215
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://www.openssl.org/news/secadv/20230207.txt |  |
| nvd | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=c3829dd8825c654652201e16f8a0a0c46ee3f344 |  |
| nvd | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9816136fe31d92ace4037d5da5257f763aeeb4eb |  |
| nvd | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8818064ce3c3c0f1b740a5aaba2a987e75bfbafd |  |
| redhat | https://access.redhat.com/security/cve/CVE-2023-0215 |  |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:0946 | https://bugzilla.redhat.com/show_bug.cgi?id=2164492 |
| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0215 | https://ubuntu.com/security/CVE-2023-0215 |
| ubuntu | https://www.openssl.org/news/secadv/20230207.txt | https://ubuntu.com/security/CVE-2023-0215 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2023-0215 | https://ubuntu.com/security/CVE-2023-0215 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2023-0215 | https://ubuntu.com/security/CVE-2023-0215 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2023-0215 | https://ubuntu.com/security/CVE-2023-0215 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2023-0215 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2023-0215 |
| cve_search |  | https://www.openssl.org/news/secadv/20230207.txt |
| github_advisory | https://nvd.nist.gov/vuln/detail/CVE-2023-0215 | https://github.com/advisories/GHSA-r7jw-wp68-3xch |
| github_advisory | https://rustsec.org/advisories/RUSTSEC-2023-0009.html | https://github.com/advisories/GHSA-r7jw-wp68-3xch |
| github_advisory | https://www.openssl.org/news/secadv/20230207.txt | https://github.com/advisories/GHSA-r7jw-wp68-3xch |
| freebsd | https://www.openssl.org/news/secadv/20230207.txt | https://www.freebsd.org/security/advisories/FreeBSD-SA-23:03.openssl.asc |
| freebsd | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0286 | https://www.freebsd.org/security/advisories/FreeBSD-SA-23:03.openssl.asc |
| freebsd | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0215 | https://www.freebsd.org/security/advisories/FreeBSD-SA-23:03.openssl.asc |
| freebsd | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4450 | https://www.freebsd.org/security/advisories/FreeBSD-SA-23:03.openssl.asc |
| freebsd | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4304 | https://www.freebsd.org/security/advisories/FreeBSD-SA-23:03.openssl.asc |
| freebsd | https://security.FreeBSD.org/ | https://www.freebsd.org/security/advisories/FreeBSD-SA-23:03.openssl.asc |
| freebsd | https://security.FreeBSD.org/advisories/FreeBSD-SA-23:03.openssl.asc | https://www.freebsd.org/security/advisories/FreeBSD-SA-23:03.openssl.asc |
| nvd | https://www.openssl.org/news/secadv/20230207.txt |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

无
</details>

二、漏洞分析结构反馈
 影响性分析说明：
      公共 API 函数 BIO_new_NDEF 是一个辅助函数，用于通过 BIO 流式传输 ASN.1 数据。它主要在 OpenSSL 内部使用以支持 SMIME、CMS 和 PKCS7 流功能，但也可以由最终用户应用程序直接调用。该函数从调用者那里接收一个 BIO，在其前面添加一个新的 BIO_f_asn1 过滤器 BIO 以形成一个 BIO 链，然后将新的 BIO 链头返回给调用者。在某些情况下，例如，如果 CMS 接收者公钥无效，则新过滤器 BIO 被释放并且该函数返回 NULL 结果表明失败。然而，在这种情况下，BIO 链没有被正确清理，调用者传递的 BIO 仍然保留指向先前释放的过滤器 BIO 的内部指针。如果调用者继续调用 BIO 上的 BIO_pop() ，那么将发生释放后使用。这很可能会导致崩溃。这种情况直接发生在内部函数 B64_write_ASN1() 中，这可能会导致 BIO_new_NDEF() 被调用，随后将调用 BIO 上的 BIO_pop()。此内部函数依次由公共 API 函数 PEM_write_bio_ASN1_stream、PEM_write_bio_CMS_stream、PEM_write_bio_PKCS7_stream、SMIME_write_ASN1、SMIME_write_CMS 和 SMIME_write_PKCS7 调用。可能受此影响的其他公共 API 函数包括 i2d_ASN1_bio_stream、BIO_new_CMS、BIO_new_PKCS7、i2d_CMS_bio_stream 和 i2d_PKCS7_bio_stream。OpenSSL cms 和 smime 命令行应用程序同样受到影响。这种情况直接发生在内部函数 B64_write_ASN1() 中，这可能会导致 BIO_new_NDEF() 被调用，随后将调用 BIO 上的 BIO_pop()。此内部函数依次由公共 API 函数 PEM_write_bio_ASN1_stream、PEM_write_bio_CMS_stream、PEM_write_bio_PKCS7_stream、SMIME_write_ASN1、SMIME_write_CMS 和 SMIME_write_PKCS7 调用。可能受此影响的其他公共 API 函数包括 i2d_ASN1_bio_stream、BIO_new_CMS、BIO_new_PKCS7、i2d_CMS_bio_stream 和 i2d_PKCS7_bio_stream。OpenSSL cms 和 smime 命令行应用程序同样受到影响。这种情况直接发生在内部函数 B64_write_ASN1() 中，这可能会导致 BIO_new_NDEF() 被调用，随后将调用 BIO 上的 BIO_pop()。此内部函数依次由公共 API 函数 PEM_write_bio_ASN1_stream、PEM_write_bio_CMS_stream、PEM_write_bio_PKCS7_stream、SMIME_write_ASN1、SMIME_write_CMS 和 SMIME_write_PKCS7 调用。可能受此影响的其他公共 API 函数包括 i2d_ASN1_bio_stream、BIO_new_CMS、BIO_new_PKCS7、i2d_CMS_bio_stream 和 i2d_PKCS7_bio_stream。OpenSSL cms 和 smime 命令行应用程序同样受到影响。SMIME_write_ASN1、SMIME_write_CMS 和 SMIME_write_PKCS7。可能受此影响的其他公共 API 函数包括 i2d_ASN1_bio_stream、BIO_new_CMS、BIO_new_PKCS7、i2d_CMS_bio_stream 和 i2d_PKCS7_bio_stream。OpenSSL cms 和 smime 命令行应用程序同样受到影响。SMIME_write_ASN1、SMIME_write_CMS 和 SMIME_write_PKCS7。可能受此影响的其他公共 API 函数包括 i2d_ASN1_bio_stream、BIO_new_CMS、BIO_new_PKCS7、i2d_CMS_bio_stream 和 i2d_PKCS7_bio_stream。OpenSSL cms 和 smime 命令行应用程序同样受到影响。  
 openEuler评分：
  7.5
 Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.master(16.15.0):受影响
2.openEuler-20.03-LTS-SP1(12.22.11):受影响
3.openEuler-20.03-LTS-SP3(12.22.11):受影响
4.openEuler-22.03-LTS-Next(12.22.11):受影响
5.openEuler-22.03-LTS(12.22.11):受影响
6.openEuler-22.03-LTS-SP1(12.22.11):受影响
7.openEuler-23.03(16.15.0):受影响

修复是否涉及abi变化(是/否)：
  1.master(16.15.0):否
2.openEuler-20.03-LTS-SP1(12.22.11):否
3.openEuler-20.03-LTS-SP3(12.22.11):否
4.openEuler-22.03-LTS-Next(12.22.11):否
5.openEuler-22.03-LTS(12.22.11):否
6.openEuler-22.03-LTS-SP1(12.22.11):否
7.openEuler-23.03(16.15.0):否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2023-1142

src-openEuler/nodejs
关闭

内容风险标识

评论 (12)

src-openEuler/nodejs关闭 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2023-0215

评论 (12)

搜索帮助

src-openEuler/nodejs
关闭