VYPR
← All advisories
Critical severityNVD Advisory· Published Aug 24, 2021· Updated Sep 16, 2024

SM2 Decryption Buffer Overflow

CVE-2021-3711

Description

In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

OpenSSL SM2 decryption code miscalculates buffer size, leading to a heap buffer overflow of up to 62 bytes when an application calls EVP_PKEY_decrypt() twice.

Vulnerability

OpenSSL versions 1.1.1 through 1.1.1k contain a buffer overflow in the SM2 decryption implementation. The bug occurs in the EVP_PKEY_decrypt() function when an application uses the typical two-call pattern: the first call (with out set to NULL) returns a buffer size in outlen that can be smaller than the actual required size for the decrypted plaintext. When the application allocates a buffer based on that size and calls EVP_PKEY_decrypt() a second time, the decryption writes up to 62 bytes beyond the allocated buffer [1][3].

Exploitation

An attacker must be able to supply SM2-encrypted content to a vulnerable application that uses the EVP_PKEY_decrypt() API in the recommended two-step manner. No authentication, network position, or user interaction beyond processing the crafted ciphertext is required. The attacker can control the overflow content, as the extra bytes come from the decrypted plaintext [1][3].

Impact

Successful exploitation results in a heap-based buffer overflow of up to 62 bytes. The overflow can corrupt adjacent heap memory, potentially leading to application crash or, in a worst case, arbitrary code execution depending on the application's memory layout. The CVSS score is 9.8 (Critical) reflecting the low complexity and high potential for full CIA compromise [4].

Mitigation

Fixed in OpenSSL 1.1.1l, released on 24 August 2021. OpenSSL 1.0.2 is not affected. Users of OpenSSL 3.0 alpha/beta should upgrade to the final release which includes the fix. No workaround is available other than applying the patch or upgrade [3][1].

References
  1. NVD - CVE-2021-3711
  2. https://www.openssl.org/news/secadv/20210824.txt
  3. SM2 Decryption Buffer Overflow › RustSec Advisory Database

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
openssl-srccrates.io
< 111.16.0111.16.0

Affected products

131

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

26

News mentions

0

No linked articles in our index yet.