Double free after calling PEM_read_bio_ex

CVE-2022-4450

Summary

The vulnerability arises in the PEM_read_bio_ex() function of OpenSSL, which processes PEM files. If it encounters a malformed file resulting in 0 bytes of payload, it fails but still provides a pointer to a buffer that may have already been deallocated. When the caller attempts to free this buffer again, a double free condition occurs, potentially leading to application crashes. An attacker can exploit this vulnerability by supplying specially crafted PEM files, creating avenues for denial of service attacks. This issue also affects wrapper functions like PEM_read_bio() and PEM_read(), as well as other OpenSSL functions that indirectly call PEM_read_bio_ex().

References