CVE-2022-38152
published 2022-08-31CVE-2022-38152: An issue was discovered in wolfSSL before 5.5.0. When a TLS 1.3 client connects to a wolfSSL server and SSL_clear is called on its session, the server crashes…
PriorityP339high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
2.12%
79.8th percentile
An issue was discovered in wolfSSL before 5.5.0. When a TLS 1.3 client connects to a wolfSSL server and SSL_clear is called on its session, the server crashes with a segmentation fault. This occurs in the second session, which is created through TLS session resumption and reuses the initial struct WOLFSSL. If the server reuses the previous session structure (struct WOLFSSL) by calling wolfSSL_clear(WOLFSSL* ssl) on it, the next received Client Hello (that resumes the previous session) crashes the server. Note that this bug is only triggered when resuming sessions using TLS session resumption. Only servers that use wolfSSL_clear instead of the recommended SSL_free; SSL_new sequence are affected. Furthermore, wolfSSL_clear is part of wolfSSL's compatibility layer and is not enabled by default. It is not part of wolfSSL's native API.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | wolfssl | < wolfssl 5.5.3-1 (bookworm) | wolfssl 5.5.3-1 (bookworm) |
| wolfssl | wolfssl | < 5.5.0 | 5.5.0 |
| wolfssl | wolfssl | >= 0 < 5.5.3-1 | 5.5.3-1 |
| wolfssl | wolfssl | >= 0 < 5.5.3-1 | 5.5.3-1 |
| wolfssl | wolfssl | >= 0 < 5.5.3-1 | 5.5.3-1 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
wolfSSL up to 5.4.x Session SSL_clear memory corruption (EUVD-2022-40749)
vuldb·2026-06-22·CVSS 7.5
CVE-2022-38152 [HIGH] wolfSSL up to 5.4.x Session SSL_clear memory corruption (EUVD-2022-40749)
A vulnerability labeled as critical has been found in wolfSSL up to 5.4.x. Affected by this vulnerability is the function SSL_clear of the component Session Handler. Executing a manipulation can lead to memory corruption.
This vulnerability appears as CVE-2022-38152. The attack may be performed from remote. There is no available exploit.
The affected component should be upgraded.
GHSA
GHSA-g986-42m5-mxwm: An issue was discovered in wolfSSL before 5
ghsa_unreviewed·2022-09-01
CVE-2022-38152 [HIGH] CWE-754 GHSA-g986-42m5-mxwm: An issue was discovered in wolfSSL before 5
An issue was discovered in wolfSSL before 5.5.0. When a TLS 1.3 client connects to a wolfSSL server and SSL_clear is called on its session, the server crashes with a segmentation fault. This occurs in the second session, which is created through TLS session resumption and reuses the initial struct WOLFSSL. If the server reuses the previous session structure (struct WOLFSSL) by calling wolfSSL_clear(WOLFSSL* ssl) on it, the next received Client Hello (that resumes the previous session) crashes the server. Note that this bug is only triggered when resuming sessions using TLS session resumption. Only servers that use wolfSSL_clear instead of the recommended SSL_free; SSL_new sequence are affected. Furthermore, wolfSSL_clear is part of wolfSSL's compatibility layer and is not enabled by defaul
OSV
CVE-2022-38152: An issue was discovered in wolfSSL before 5
osv·2022-08-31·CVSS 7.5
CVE-2022-38152 [HIGH] CVE-2022-38152: An issue was discovered in wolfSSL before 5
An issue was discovered in wolfSSL before 5.5.0. When a TLS 1.3 client connects to a wolfSSL server and SSL_clear is called on its session, the server crashes with a segmentation fault. This occurs in the second session, which is created through TLS session resumption and reuses the initial struct WOLFSSL. If the server reuses the previous session structure (struct WOLFSSL) by calling wolfSSL_clear(WOLFSSL* ssl) on it, the next received Client Hello (that resumes the previous session) crashes the server. Note that this bug is only triggered when resuming sessions using TLS session resumption. Only servers that use wolfSSL_clear instead of the recommended SSL_free; SSL_new sequence are affected. Furthermore, wolfSSL_clear is part of wolfSSL's compatibility layer and is not enabled by defaul
Debian
CVE-2022-38152: wolfssl - An issue was discovered in wolfSSL before 5.5.0. When a TLS 1.3 client connects ...
vendor_debian·2022·CVSS 7.5
CVE-2022-38152 [HIGH] CVE-2022-38152: wolfssl - An issue was discovered in wolfSSL before 5.5.0. When a TLS 1.3 client connects ...
An issue was discovered in wolfSSL before 5.5.0. When a TLS 1.3 client connects to a wolfSSL server and SSL_clear is called on its session, the server crashes with a segmentation fault. This occurs in the second session, which is created through TLS session resumption and reuses the initial struct WOLFSSL. If the server reuses the previous session structure (struct WOLFSSL) by calling wolfSSL_clear(WOLFSSL* ssl) on it, the next received Client Hello (that resumes the previous session) crashes the server. Note that this bug is only triggered when resuming sessions using TLS session resumption. Only servers that use wolfSSL_clear instead of the recommended SSL_free; SSL_new sequence are affected. Furthermore, wolfSSL_clear is part of wolfSSL's compatibility layer and is not enabled by defaul
No detection rules found.
No public exploits indexed.
Trailofbits
Keeping the wolves out of wolfSSL
blogs_trailofbits·2023-01-12·CVSS 6.5
CVE-2022-38152 [MEDIUM] Keeping the wolves out of wolfSSL
Trail of Bits is publicly disclosing four vulnerabilities that affect wolfSSL: CVE-2022-38152, CVE-2022-38153, CVE-2022-39173, and CVE-2022-42905. The four issues, which have CVSS scores ranging from medium to critical, can all result in a denial of service (DoS). These vulnerabilities have been discovered automatically using the novel protocol fuzzer tlspuffin. This blog post will explore these vulnerabilities, then provide an in-depth overview of the fuzzer.
tlspuffin is a fuzzer inspired by formal protocol verification. Initially developed as part of my internship at LORIA, INRIA, France, it is especially targeted against cryptographic protocols like TLS or SSH.
During my internship at Trail of Bits, we pushed protocol fuzzing even further by supporting a new protocol (SSH), adding mo
Trailofbits
Keeping the wolves out of wolfSSL
blogs_trailofbits·2023-01-12·CVSS 6.5
CVE-2022-38152 [MEDIUM] Keeping the wolves out of wolfSSL
Trail of Bits is publicly disclosing four vulnerabilities that affect wolfSSL: CVE-2022-38152 , CVE-2022-38153 , CVE-2022-39173 , and CVE-2022-42905 . The four issues, which have CVSS scores ranging from medium to critical, can all result in a denial of service (DoS). These vulnerabilities have been discovered automatically using the novel protocol fuzzer tlspuffin . This blog post will explore these vulnerabilities, then provide an in-depth overview of the fuzzer.
tlspuffin is a fuzzer inspired by formal protocol verification. Initially developed as part of my internship at LORIA, INRIA, France , it is especially targeted against cryptographic protocols like TLS or SSH.
During my internship at Trail of Bits, we pushed protocol fuzzing even further by supporting a new protocol (SSH), add
http://packetstormsecurity.com/files/170604/wolfSSL-Session-Resumption-Denial-Of-Service.htmlhttp://seclists.org/fulldisclosure/2023/Jan/7https://blog.trailofbits.com/2023/01/12/wolfssl-vulnerabilities-tlspuffin-fuzzing-ssh/https://github.com/tlspuffin/tlspuffinhttps://github.com/wolfSSL/wolfssl/pull/5468https://github.com/wolfSSL/wolfssl/releaseshttps://www.wolfssl.com/docs/security-vulnerabilities/http://packetstormsecurity.com/files/170604/wolfSSL-Session-Resumption-Denial-Of-Service.htmlhttp://seclists.org/fulldisclosure/2023/Jan/7https://blog.trailofbits.com/2023/01/12/wolfssl-vulnerabilities-tlspuffin-fuzzing-ssh/https://github.com/tlspuffin/tlspuffinhttps://github.com/wolfSSL/wolfssl/pull/5468https://github.com/wolfSSL/wolfssl/releaseshttps://www.wolfssl.com/docs/security-vulnerabilities/
2022-08-31
Published