Overview

return result:critical{
  name = "CVE-2024-5535",
  description = "Buffer over-read in the `SSL_select_next_proto` function of OpenSSL",
  provenance = {
    kind = "posix.ELF",
    linkage = "project",
    vendor = "openssl",
    product = "openssl",
    license = "Apache-2.0",
    affected_versions = {
      "<1.0.2zk", "<1.1.1za", "<3.0.15", "<3.1.7", "<3.2.3", "<3.3.2"
    }
  },
  cwes = {"CWE-200"},
  mbcs = {"OC0006", "B0011"},
  cvss = cvss:v3_1{
    base = "9.1",
    exploitability = "3.9",
    impact = "5.2",
    vector = "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"
  },
  advisory = "https://openssl-library.org/news/secadv/20240627.txt",
  identifiers = {"CVE-2024-5535", "GHSA-4fc7-mvrr-wv2c"},
  variants = {
    ["OpenSSL"] = {
      severity = "low",
      references = {
        ["OpenSSL Advisory"] = "https://openssl-library.org/news/secadv/20240627.txt"
      },
      notes = {
        ["Note"] = "OpenSSL calculated severity differs from CISA-ADP calculations"
      }
    }
  },
  patch = "https://github.com/openssl/openssl/commit/e86ac436f0bd54d4517745483e2315650fae7b2c.patch",
  source = "https://github.com/openssl/openssl/blob/openssl-3.0.12/ssl/ssl_lib.c",
  evidence = {
    functions = {
      [context.address] = {
        annotate:prototype(prototype),
        annotate:at{
          location = context.address,
          message = "The `SSL_select_next_proto` function does not properly validate the client buffer (5th parameter)."
        },
        annotate:at{
          location = address,
          message = "Passing an empty buffer can result in a crash or memory leak due to the return of an invalid memory pointer."
        }
      }
    }
  }
}