Loading vulnerability…
CVE-2022-0778 is a denial-of-service vulnerability in OpenSSL caused by a bug in the BN_mod_sqrt() function, which computes a modular square root. When BN_mod_sqrt() is invoked with non-prime moduli, it can enter an infinite loop due to an unreachable exit condition. The vulnerable code path is reachable during parsing of certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a compressed base point, as well as during parsing of crafted private keys containing explicit elliptic curve parameters. Because certificate parsing occurs before certificate signature verification, an attacker can supply a malformed certificate with invalid explicit curve parameters and trigger the loop in any process that parses externally supplied certificates. Affected OpenSSL branches include 1.0.2, 1.1.1, and 3.0. In OpenSSL 1.0.2, initial certificate parsing does not immediately parse the public key, making exploitation slightly less direct, but any later operation requiring the certificate public key can still trigger the infinite loop, including verification of a self-signed certificate.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository provides a proof-of-concept (PoC) exploit for CVE-2022-0778, a vulnerability in OpenSSL's BN_mod_sqrt() function. The vulnerability allows an attacker to craft a malicious X.509 certificate or EC parameters that, when parsed by a vulnerable OpenSSL instance, causes the process to enter an infinite loop, resulting in a Denial of Service (DoS). The repository contains: - Two C source files: 'my_bad_sqrt.c' (demonstrates the infinite loop in BN_mod_sqrt() directly) and 'my_bad_group.c' (generates malicious EC parameters that can be used to trigger the bug via OpenSSL's EC parameter parsing). - A bash script 'create_cert.sh' to generate EC keys and certificates with explicit parameters and compressed points, which are required to trigger the bug. - Several certificate and template files in the 'certs/' directory, including ASN.1 templates and DER-encoded certificates crafted to exploit the vulnerability. The exploit works by creating a certificate or EC parameters with a non-prime field, which violates the assumptions of the Tonelli-Shanks algorithm used in BN_mod_sqrt(). When OpenSSL attempts to parse such a certificate (e.g., during an SSL/TLS handshake or certificate verification), it enters an infinite loop, consuming 100% CPU and effectively causing a DoS. The attack vector is network-based, as an attacker can supply the malicious certificate during a handshake or other certificate parsing operation. No hardcoded IPs, domains, or network endpoints are present; the exploit targets the certificate parsing logic of OpenSSL. The repository is well-documented, with a detailed README explaining the mathematics and exploitation process.
This repository is a Proof-of-Concept (PoC) exploit for CVE-2022-0778, a vulnerability in OpenSSL's handling of elliptic curve parameters in X.509 certificates. The exploit is implemented in Go and includes both a custom TLS server and client, as well as test scripts and Dockerfiles for easy deployment and testing. The main exploit logic is in `client/main.go` and `server/main.go`. Both use a malicious certificate (`badcert.der`, embedded via Go's `embed` directive in `certfile/cert.go`) to trigger the vulnerability. The client connects to a target server and initiates a TLS handshake using the malicious certificate, while the server can be used to test vulnerable clients. The payload causes the vulnerable OpenSSL process to enter an infinite loop, resulting in a denial of service (DoS). The repository includes: - Go code for the exploit client and server - A custom TLS implementation (forked or adapted from Go's crypto/tls) - Certificates and keys for TLS - Test scripts and a Python server for integration testing - Dockerfiles for building and running the exploit and test environments The exploit targets OpenSSL versions prior to 1.1.1n and 3.0.2. The attack vector is network-based, requiring the attacker to connect to a vulnerable server or client and perform a TLS handshake with the malicious certificate. The main fingerprintable endpoints are the TCP addresses used for testing (127.0.0.1:12345, 0.0.0.0:12345, host.docker.internal:12345) and the certificate files used in the handshake.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An OpenSSL vulnerability in BN_mod_sqrt() that can cause an infinite loop for non-prime moduli.
Issue described as difficult to encounter inside the FIPS boundary.
A denial-of-service vulnerability in OpenSSL's BN_mod_sqrt() function that can cause an infinite loop when parsing crafted certificates or private keys containing invalid elliptic curve parameters.
A high-severity denial-of-service vulnerability in the OpenSSL library that can cause resource exhaustion during certificate parsing.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.