Invalid handling of X509_verify_cert() internal errors in libssl

Vulnerability

In OpenSSL 3.0.0, the libssl library calls X509_verify_cert() internally on the client side to verify a certificate supplied by a server. This function may return a negative return value to indicate an internal error (e.g., out of memory). OpenSSL mishandles such a negative return value, causing an IO function (such as SSL_connect() or SSL_do_handshake()) to not indicate success. A subsequent call to SSL_get_error() returns SSL_ERROR_WANT_RETRY_VERIFY, a value only supposed to be returned if the application has previously called SSL_CTX_set_cert_verify_callback() [1][3]. This issue is compounded by a separate bug in OpenSSL 3.0 that causes X509_verify_cert() to indicate an internal error when processing a certificate chain lacking the Subject Alternative Name extension but where a Certificate Authority has enforced name constraints, even with valid chains [1][3]. Only OpenSSL 3.0.0 is affected; OpenSSL 1.1.1 and 1.0.2 are not [3].

Exploitation

An attacker controlling a server can craft a TLS certificate chain that triggers an internal error in X509_verify_cert() due to the name constraints bug. The attacker does not need special authentication or write access; they only need to induce a TLS connection from a client using OpenSSL 3.0.0. No user interaction beyond initiating the TLS handshake is required. The mismanagement of the negative return value leads to SSL_get_error() returning the unexpected SSL_ERROR_WANT_RETRY_VERIFY value, which most applications are not programmed to handle [1][3]. The exact sequence depends on the application, but the attack is feasible by combining the two issues [3].

Impact

A successful exploit can cause application-dependent incorrect behavior, including crashes, infinite loops, or other denial-of-service conditions. The attacker does not gain code execution or data disclosure; the impact is primarily a denial of service. The vulnerability does not compromise the confidentiality or integrity of the TLS session itself, but can render the client application unresponsive or unstable [1][3].

Mitigation

The fix is included in OpenSSL 3.0.1, released on December 14, 2021 [1][3]. Users of OpenSSL 3.0.0 should upgrade to 3.0.1 immediately. OpenSSL 1.1.1 and 1.0.2 are unaffected. No workaround is available for 3.0.0; upgrading is the only mitigation. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.