CVE-2022-28327: Integer Overflow
An integer overflow flaw was found in Golang's crypto/elliptic library. This flaw allows an attacker to use a crafted scaler input longer than 32 bytes, causing P256().ScalarMult or P256().ScalarBaseMult to panic, leading to a loss of availability.
Other sources
crypto/elliptic: tolerate all oversized scalars in generic P-256
A crafted scalar input longer than 32 bytes can cause P256().ScalarMult or P256().ScalarBaseMult to panic. Indirect uses through crypto/ecdsa and crypto/tls are unaffected. amd64, arm64, ppc64le, and s390x are unaffected.
This was discovered thanks to a Project Wycheproof test vector.
This is CVE-2022-28327 and https://go.dev/issue/52075.
— Red Hat
Golang Go is vulnerable to a denial of service, caused by improper input validaiton by the generic P-256 feature in crypto/elliptic. By sending a specially-crafted request with long scalar input, a remote attacker could exploit this vulnerability to cause a panic on the system.
— IBM
The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
- RHSA-2022:6187
- RHSA-2022:6290
- RHSA-2023:1042
- RHSA-2023:3664
- RHSA-2022:6040
- RHSA-2022:6042
- RHSA-2022:5006
- RHSA-2022:6277
- RHSA-2022:6152
- RHSA-2023:3642
- RHSA-2022:5415
- RHSA-2022:5337
- RHSA-2022:5799
- RHSA-2022:5840
- RHSA-2022:5729
- RHSA-2022:6094
- RHSA-2022:5875
- RHSA-2022:5068
- RHSA-2023:3914
- RHSA-2022:6155
- RHSA-2022:6156
- RHSA-2022:6714
- RHSA-2022:6526
- RHSA-2022:8750
- RHSA-2023:4003
- RHSA-2023:1529
- IBM-7080058
Frequently Asked Questions
What is CVE-2022-28327?
CVE-2022-28327 is an integer overflow vulnerability in Golang's crypto/elliptic library.
How does CVE-2022-28327 impact the affected software?
CVE-2022-28327 allows an attacker to cause P256().ScalarMult or P256().ScalarBaseMult to panic, leading to a loss of availability.
What is the severity of CVE-2022-28327?
CVE-2022-28327 has a severity rating of 7.5 (High).
How do I fix CVE-2022-28327 in Go?
To fix CVE-2022-28327 in Go, upgrade to version 1.17.9 or 1.18.1.
Where can I find more information about CVE-2022-28327?
More information about CVE-2022-28327 can be found at the following links: - [Red Hat Security Advisory](https://access.redhat.com/security/cve/CVE-2022-28327) - [Go Issue Tracker](https://go.dev/issue/52075) - [Go Source Code](https://go-review.googlesource.com/c/go/+/397135/)