CVE-2024-9143

一、漏洞信息
 漏洞编号：[CVE-2024-9143](https://nvd.nist.gov/vuln/detail/CVE-2024-9143)
 漏洞归属组件：[edk2](https://gitee.com/src-openeuler/edk2)
 漏洞归属的版本：202002,202011,202308
 CVSS V3.0分值：
  BaseScore：4.3 Medium
  Vector：CVSS：3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
 漏洞简述：
  Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrustedexplicit values for the field polynomial can lead to out-of-bounds memory readsor writes.Impact summary: Out of bound memory writes can lead to an application crash oreven a possibility of a remote code execution, however, in all the protocolsinvolving Elliptic Curve Cryptography that we re aware of, either only  namedcurves  are supported, or, if explicit curve parameters are supported, theyspecify an X9.62 encoding of binary (GF(2^m)) curves that can t representproblematic input values. Thus the likelihood of existence of a vulnerableapplication is low.In particular, the X9.62 encoding is used for ECC keys in X.509 certificates,so problematic inputs cannot occur in the context of processing X.509certificates.  Any problematic use-cases would have to be using an  exotic curve encoding.The affected APIs include: EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(),and various supporting BN_GF2m_*() functions.Applications working with  exotic  explicit binary (GF(2^m)) curve parameters,that make it possible to represent invalid field polynomials with a zeroconstant term, via the above or similar APIs, may terminate abruptly as aresult of reading or writing outside of array bounds.  Remote code executioncannot easily be ruled out.The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.
 漏洞公开时间：2024-10-17 01:15:18
 漏洞创建时间：2025-03-11 20:46:15
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-9143
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| openssl-security.openssl.org | https://github.com/openssl/openssl/commit/72ae83ad214d2eef262461365a1975707f862712 |  |
| openssl-security.openssl.org | https://github.com/openssl/openssl/commit/bc7e04d7c8d509fb78fc0e285aa948fb0da04700 |  |
| openssl-security.openssl.org | https://github.com/openssl/openssl/commit/c0d3e4d32d2805f49bec30547f225bc4d092e1f4 |  |
| openssl-security.openssl.org | https://github.com/openssl/openssl/commit/fdf6723362ca51bd883295efe206cb5b1cfa5154 |  |
| openssl-security.openssl.org | https://github.openssl.org/openssl/extended-releases/commit/8efc0cbaa8ebba8e116f7b81a876a4123594d86a |  |
| openssl-security.openssl.org | https://github.openssl.org/openssl/extended-releases/commit/9d576994cec2b7aa37a91740ea7e680810957e41 |  |
| openssl-security.openssl.org | https://openssl-library.org/news/secadv/20241016.txt |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-9143 | https://bugzilla.suse.com/show_bug.cgi?id=1231741 |
| suse_bugzilla | https://seclists.org/oss-sec/2024/q4/33 | https://bugzilla.suse.com/show_bug.cgi?id=1231741 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-9143 | https://bugzilla.suse.com/show_bug.cgi?id=1231741 |
| suse_bugzilla | https://github.com/openssl/openssl/commit/72ae83ad214d2eef262461365a1975707f862712 | https://bugzilla.suse.com/show_bug.cgi?id=1231741 |
| suse_bugzilla | https://github.com/openssl/openssl/commit/bc7e04d7c8d509fb78fc0e285aa948fb0da04700 | https://bugzilla.suse.com/show_bug.cgi?id=1231741 |
| suse_bugzilla | https://github.com/openssl/openssl/commit/c0d3e4d32d2805f49bec30547f225bc4d092e1f4 | https://bugzilla.suse.com/show_bug.cgi?id=1231741 |
| suse_bugzilla | https://github.com/openssl/openssl/commit/fdf6723362ca51bd883295efe206cb5b1cfa5154 | https://bugzilla.suse.com/show_bug.cgi?id=1231741 |
| suse_bugzilla | https://github.openssl.org/openssl/extended-releases/commit/8efc0cbaa8ebba8e116f7b81a876a4123594d86a | https://bugzilla.suse.com/show_bug.cgi?id=1231741 |
| suse_bugzilla | https://github.openssl.org/openssl/extended-releases/commit/9d576994cec2b7aa37a91740ea7e680810957e41 | https://bugzilla.suse.com/show_bug.cgi?id=1231741 |
| suse_bugzilla | https://openssl-library.org/news/secadv/20241016.txt | https://bugzilla.suse.com/show_bug.cgi?id=1231741 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-9143 |
| oracle |  | https://www.oracle.com/security-alerts/cpujan2025.html |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2024-9143 |
| mageia |  | http://advisories.mageia.org/MGASA-2024-0354.html |
| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2024-9143 | https://explore.alas.aws.amazon.com/CVE-2024-9143.html |
| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-9143 | https://explore.alas.aws.amazon.com/CVE-2024-9143.html |
| alpine | https://openssl-library.org/news/secadv/20241016.txt | https://security.alpinelinux.org/vuln/CVE-2024-9143 |
| alpine | https://github.com/openssl/openssl/commit/c0d3e4d32d2805f49bec30547f225bc4d092e1f4 | https://security.alpinelinux.org/vuln/CVE-2024-9143 |
| alpine | https://github.com/openssl/openssl/commit/bc7e04d7c8d509fb78fc0e285aa948fb0da04700 | https://security.alpinelinux.org/vuln/CVE-2024-9143 |
| alpine | https://github.com/openssl/openssl/commit/fdf6723362ca51bd883295efe206cb5b1cfa5154 | https://security.alpinelinux.org/vuln/CVE-2024-9143 |
| alpine | https://github.com/openssl/openssl/commit/72ae83ad214d2eef262461365a1975707f862712 | https://security.alpinelinux.org/vuln/CVE-2024-9143 |
| alpine | https://github.openssl.org/openssl/extended-releases/commit/8efc0cbaa8ebba8e116f7b81a876a4123594d86a | https://security.alpinelinux.org/vuln/CVE-2024-9143 |
| alpine | https://github.openssl.org/openssl/extended-releases/commit/9d576994cec2b7aa37a91740ea7e680810957e41 | https://security.alpinelinux.org/vuln/CVE-2024-9143 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  其它
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://github.com/openssl/openssl/commit/72ae83ad214d2eef262461365a1975707f862712 |  | openssl-security.openssl.org |
|  |  | https://github.com/openssl/openssl/commit/bc7e04d7c8d509fb78fc0e285aa948fb0da04700 |  | openssl-security.openssl.org |
|  |  | https://github.com/openssl/openssl/commit/c0d3e4d32d2805f49bec30547f225bc4d092e1f4 |  | openssl-security.openssl.org |
|  |  | https://github.com/openssl/openssl/commit/fdf6723362ca51bd883295efe206cb5b1cfa5154 |  | openssl-security.openssl.org |
|  |  | https://github.openssl.org/openssl/extended-releases/commit/8efc0cbaa8ebba8e116f7b81a876a4123594d86a |  | openssl-security.openssl.org |
|  |  | https://github.openssl.org/openssl/extended-releases/commit/9d576994cec2b7aa37a91740ea7e680810957e41 |  | openssl-security.openssl.org |
|  |  | https://github.com/openssl/openssl/commit/72ae83ad214d2eef262461365a1975707f862712 |  | suse_bugzilla |
|  |  | https://github.com/openssl/openssl/commit/bc7e04d7c8d509fb78fc0e285aa948fb0da04700 |  | suse_bugzilla |
|  |  | https://github.com/openssl/openssl/commit/c0d3e4d32d2805f49bec30547f225bc4d092e1f4 |  | suse_bugzilla |
|  |  | https://github.com/openssl/openssl/commit/fdf6723362ca51bd883295efe206cb5b1cfa5154 |  | suse_bugzilla |
|  |  | https://github.openssl.org/openssl/extended-releases/commit/8efc0cbaa8ebba8e116f7b81a876a4123594d86a |  | suse_bugzilla |
|  |  | https://github.openssl.org/openssl/extended-releases/commit/9d576994cec2b7aa37a91740ea7e680810957e41 |  | suse_bugzilla |
|  |  | https://github.com/openssl/openssl/commit/c0d3e4d32d2805f49bec30547f225bc4d092e1f4 |  | alpine |
|  |  | https://github.com/openssl/openssl/commit/bc7e04d7c8d509fb78fc0e285aa948fb0da04700 |  | alpine |
|  |  | https://github.com/openssl/openssl/commit/fdf6723362ca51bd883295efe206cb5b1cfa5154 |  | alpine |
|  |  | https://github.com/openssl/openssl/commit/72ae83ad214d2eef262461365a1975707f862712 |  | alpine |
|  |  | https://github.openssl.org/openssl/extended-releases/commit/8efc0cbaa8ebba8e116f7b81a876a4123594d86a |  | alpine |
|  |  | https://github.openssl.org/openssl/extended-releases/commit/9d576994cec2b7aa37a91740ea7e680810957e41 |  | alpine |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrustedexplicit values for the field polynomial can lead to out-of-bounds memory readsor writes.Impact summary: Out of bound memory writes can lead to an application crash oreven a possibility of a remote code execution, however, in all the protocolsinvolving Elliptic Curve Cryptography that we re aware of, either only namedcurves are supported, or, if explicit curve parameters are supported, theyspecify an X9.62 encoding of binary (GF(2^m)) curves that can t representproblematic input values. Thus the likelihood of existence of a vulnerableapplication is low.In particular, the X9.62 encoding is used for ECC keys in X.509 certificates,so problematic inputs cannot occur in the context of processing X.509certificates. Any problematic use-cases would have to be using an exotic curve encoding.The affected APIs include: EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(),and various supporting BN_GF2m_*() functions.Applications working with exotic explicit binary (GF(2^m)) curve parameters,that make it possible to represent invalid field polynomials with a zeroconstant term, via the above or similar APIs, may terminate abruptly as aresult of reading or writing outside of array bounds. Remote code executioncannot easily be ruled out.The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.
 openEuler评分：
  4.3
 Vector：CVSS：3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
 受影响版本排查(受影响/不受影响)：
  1.master(202308):受影响
2.openEuler-20.03-LTS-SP4(202002):受影响
3.openEuler-22.03-LTS-SP3(202011):受影响
4.openEuler-22.03-LTS-SP4(202011):受影响
5.openEuler-24.03-LTS(202308):受影响
6.openEuler-24.03-LTS-Next(202308):受影响
7.openEuler-24.03-LTS-SP1(202308):受影响

修复是否涉及abi变化(是/否)：
  1.master(202308):否
2.openEuler-20.03-LTS-SP4(202002):否
3.openEuler-22.03-LTS-SP3(202011):否
4.openEuler-22.03-LTS-SP4(202011):否
5.openEuler-24.03-LTS(202308):否
6.openEuler-24.03-LTS-Next(202308):否
7.openEuler-24.03-LTS-SP1(202308):否

原因说明：
  1.master(202308):正常修复
2.openEuler-20.03-LTS-SP4(202002):正常修复
3.openEuler-22.03-LTS-SP3(202011):正常修复
4.openEuler-22.03-LTS-SP4(202011):正常修复
5.openEuler-24.03-LTS(202308):正常修复
6.openEuler-24.03-LTS-Next(202308):正常修复
7.openEuler-24.03-LTS-SP1(202308):正常修复

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-1352

src-openEuler/edk2

Content Risk Flag

Comments (5)

src-openEuler/edk2 .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-9143

Comments (5)

Search

src-openEuler/edk2