Riskcovery

CVE-2024-37305

Buffer overflow in deserialization in oqs-provider

State
Published
Severity
8.2 High
Published
Jun 17, 2024
Updated
Aug 2, 2024
Reserved
Jun 5, 2024

Read the record on cve.org

Description

oqs-provider is a provider for the OpenSSL 3 cryptography library that adds support for post-quantum cryptography in TLS, X.509, and S/MIME using post-quantum algorithms from liboqs. Flaws have been identified in the way oqs-provider handles lengths decoded with DECODE_UINT32 at the start of serialized hybrid (traditional + post-quantum) keys and signatures. Unchecked length values are later used for memory reads and writes; malformed input can lead to crashes or information leakage. Handling of plain/non-hybrid PQ key operation is not affected. This issue has been patched in in v0.6.1. All users are advised to upgrade. There are no workarounds for this issue.

Scores

CVSSScoreVectorSource
3.18.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:HGitHub_M

Weaknesses

  • CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
  • CWE-130 Improper Handling of Length Parameter Inconsistency
  • CWE-190 Integer Overflow or Wraparound
  • CWE-680 Integer Overflow to Buffer Overflow
  • CWE-805 Buffer Access with Incorrect Length Value

Affected Products

ProductVersions
oqs-provideropen-quantum-safe
  • < 0.6.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.