Incorrect Type Conversion or Cast Affecting edk2-tools package, versions <0:20200801stable-1.amzn2.0.5


Severity

Recommended
0.0
high
0
10

Based on Amazon Linux security rating.

Threat Intelligence

EPSS
0.39% (75th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-AMZN2-EDK2TOOLS-6457827
  • published19 Mar 2024
  • disclosed8 Feb 2023

Introduced: 8 Feb 2023

CVE-2023-0286  (opens in a new tab)
CWE-704  (opens in a new tab)

How to fix?

Upgrade Amazon-Linux:2 edk2-tools to version 0:20200801stable-1.amzn2.0.5 or higher.
This issue was patched in ALAS2-2024-2502.

NVD Description

Note: Versions mentioned in the description apply only to the upstream edk2-tools package and not the edk2-tools package as distributed by Amazon-Linux. See How to fix? for Amazon-Linux:2 relevant fixed versions and status.

There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING.

When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.

CVSS Scores

version 3.1