{"id":"RUSTSEC-2022-0033","revision":"56994844e20e4302814f2ae85387d172","records":[{"revision":"56994844e20e4302814f2ae85387d172","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2022-0033","aliases":["CVE-2022-2274","GHSA-735f-pg76-fxc4"],"title":"Heap memory corruption with RSA private key operation","description":"The OpenSSL 3.0.4 release introduced a serious bug in the RSA\nimplementation for X86_64 CPUs supporting the AVX512IFMA instructions.\nThis issue makes the RSA implementation with 2048 bit private keys\nincorrect on such machines and memory corruption will happen during\nthe computation. As a consequence of the memory corruption an attacker\nmay be able to trigger a remote code execution on the machine performing\nthe computation.\n\nSSL/TLS servers or other servers using 2048 bit RSA private keys running\non machines supporting AVX512IFMA instructions of the X86_64 architecture\nare affected by this issue.\n\nNote that on a vulnerable machine, proper testing of OpenSSL would fail and\nshould be noticed before deployment.","state":0,"publishedAt":"2022-07-05T12:00:00+00:00","modifiedAt":"2023-11-08T04:08:13.343319+00:00","affected":[{"ecosystem":"crates.io","name":"openssl-src","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"300.0.8"},{"kind":"fixed","version":"300.0.9"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://crates.io/crates/openssl-src","https://rustsec.org/advisories/RUSTSEC-2022-0033.html","https://www.openssl.org/news/secadv/20220705.txt"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2022-0033","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2022-0033","identifiers":["RUSTSEC-2022-0033","CVE-2022-2274","GHSA-735f-pg76-fxc4"]},"retained":false,"historicalAffected":[]}],"coverage":[]}