{"id":"RUSTSEC-2023-0009","revision":"4edb56f8c4d2466e88bf3db30f27e66d","records":[{"revision":"4edb56f8c4d2466e88bf3db30f27e66d","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2023-0009","aliases":["CVE-2023-0215","GHSA-r7jw-wp68-3xch"],"title":"Use-after-free following `BIO_new_NDEF`","description":"The public API function `BIO_new_NDEF` is a helper function used for streaming\nASN.1 data via a `BIO`. It is primarily used internally to OpenSSL to support the\nSMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by\nend user applications.\n\nThe function receives a `BIO` from the caller, prepends a new `BIO_f_asn1` filter\n`BIO` onto the front of it to form a `BIO` chain, and then returns the new head of\nthe `BIO` chain to the caller. Under certain conditions, for example if a CMS\nrecipient public key is invalid, the new filter `BIO` is freed and the function\nreturns a `NULL` result indicating a failure. However, in this case, the `BIO` chain\nis not properly cleaned up and the `BIO` passed by the caller still retains\ninternal pointers to the previously freed filter `BIO`. If the caller then goes on\nto call `BIO_pop()` on the `BIO` then a use-after-free will occur. This will most\nlikely result in a crash.\n\nThis scenario occurs directly in the internal function `B64_write_ASN1()` which\nmay cause `BIO_new_NDEF()` to be called and will subsequently call `BIO_pop()` on\nthe `BIO`. This internal function is in turn called by the public API functions\n`PEM_write_bio_ASN1_stream`, `PEM_write_bio_CMS_stream`, `PEM_write_bio_PKCS7_stream`,\n`SMIME_write_ASN1`, `SMIME_write_CMS` and `SMIME_write_PKCS7`.\n\nOther public API functions that may be impacted by this include\n`i2d_ASN1_bio_stream`, `BIO_new_CMS`, `BIO_new_PKCS7`, `i2d_CMS_bio_stream` and\n`i2d_PKCS7_bio_stream`.","state":0,"publishedAt":"2023-02-07T12:00:00+00:00","modifiedAt":"2023-11-08T04:11:06.259401+00:00","affected":[{"ecosystem":"crates.io","name":"openssl-src","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-0"},{"kind":"fixed","version":"111.25.0"},{"kind":"introduced","version":"300.0.0"},{"kind":"fixed","version":"300.0.12"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://crates.io/crates/openssl-src","https://rustsec.org/advisories/RUSTSEC-2023-0009.html","https://www.openssl.org/news/secadv/20230207.txt"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2023-0009","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2023-0009","identifiers":["RUSTSEC-2023-0009","CVE-2023-0215","GHSA-r7jw-wp68-3xch"]},"retained":false,"historicalAffected":[]}],"coverage":[]}