cbcvebase.
CVE-2012-2110
published 2012-04-19

CVE-2012-2110: The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret…

PriorityP261high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
48.30%
98.7th percentile
The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret integer data, which allows remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have unspecified other impact, via crafted DER data, as demonstrated by an X.509 certificate or an RSA public key.

Affected

80 ranges· showing 25
VendorProductVersion rangeFixed in
debianopenssl< openssl 1.0.1a-1 (bookworm)openssl 1.0.1a-1 (bookworm)
debianopenssl
opensslopenssl<= 0.9.8u
opensslopenssl
opensslopenssl
opensslopenssl
opensslopenssl
opensslopenssl
opensslopenssl
opensslopenssl
opensslopenssl
opensslopenssl
opensslopenssl
opensslopenssl
opensslopenssl
opensslopenssl
opensslopenssl
opensslopenssl
opensslopenssl
opensslopenssl
opensslopenssl
opensslopenssl
opensslopenssl
opensslopenssl
opensslopenssl

Detection & IOCsextracted from sources · hover to see the quote

pathcrypto/asn1/a_d2i_fp.c
pathcrypto/buffer/buffer.c
  • Detect crafted DER-encoded data with a length field having the 31st bit set (e.g., length value 2147483648 / 0x80000000) supplied to OpenSSL ASN.1 parsing interfaces such as d2i_X509_bio or other d2i_* BIO wrappers — this triggers the integer sign-extension/truncation in asn1_d2i_read_bio.
  • Monitor for anomalously large or negative ASN.1 length values being processed by OpenSSL — specifically a cast of c.slen (long) to a signed int producing a negative want value (e.g., c.slen=2147483648 → want=-2147483648), which precedes the heap overflow in BUF_MEM_grow_clean.
  • Flag calls to CRYPTO_realloc_clean where old_len > num, indicating the buffer-shrink path that OpenSSL does not handle safely and which results in a heap overflow memcpy.
  • Any application invoking d2i_* BIO interfaces (e.g., d2i_X509_bio) against untrusted input is a potential exploitation target; monitor process call stacks for asn1_d2i_read_bio → ASN1_item_d2i_bio → d2i_X509_bio chains processing externally supplied data.
  • ·Some attack vectors require an I32LP64 (64-bit) architecture where the sign-extension of a 32-bit signed int to size_t produces a large unexpected value; other vectors also affect 32-bit (x86) platforms.
  • ·Even applications that do not call d2i_* functions directly are affected, because many higher-level OpenSSL APIs invoke them internally when handling untrusted data.

CVSS provenance

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
vendor_debian7.5LOW
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.