CVE-2021-3711 is a critical vulnerability affecting OpenSSL versions 1.1.1 to 1.1.1k. It involves a buffer overflow in the SM2 decryption code, which can be exploited by a malicious attacker to alter the contents of other data held after the buffer, potentially causing the application to crash or changing its behavior. The vulnerability impacts a wide range of systems, including those using OpenSSL, Debian Linux, NetApp products, Oracle products, and Tenable products. For a non-technical audience, this means that certain systems using OpenSSL for secure communication may be at risk of being compromised or crashing due to this vulnerability.

How do I know if I'm affected?

To determine if you're affected by the vulnerability, check if your system uses OpenSSL versions 1.1.1 to 1.1.1k, Debian Linux versions 10.0 and 11.0, or certain versions of NetApp, Oracle, and Tenable products. The vulnerability is related to the decryption of SM2-encrypted data using the EVP_PKEY_decrypt() function. If an attacker presents SM2 content for decryption, it can lead to a buffer overflow, altering other data and potentially causing crashes or changes in application behavior.

What should I do if I'm affected?

If you're affected by the vulnerability, it's crucial to upgrade your OpenSSL software to a secure version. For OpenSSL 1.1.1k and below, upgrade to version 1.1.1l. Follow your system's specific update process, and consult the OpenSSL Security Advisory for more information.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2021-3711 vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog. This vulnerability, also known as the SM2 Decryption Buffer Overflow, affects OpenSSL versions 1.1.1 to 1.1.1k. It can be exploited by an attacker to alter data or crash the application.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-120, which is refers to a classic buffer overflow issue. This vulnerability affects OpenSSL versions 1.1.1k and below, causing potential application crashes or altered behavior. Upgrading to OpenSSL 1.1.1l is recommended.

For more details

CVE-2021-3711 is a critical vulnerability affecting OpenSSL, with a severity of 9.8. It involves a buffer overflow in the SM2 decryption code, which can be exploited by an attacker to alter data or crash the application. To protect your system, upgrade to OpenSSL 1.1.1l. For a comprehensive understanding of the vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or the links below.

• oss-security - OpenSSL SM2 Decryption Buffer Overflow (CVE-2021-3711), Read buffer overruns processing ASN.1 strings (CVE-2021-3712)

• [SECURITY\] [DSA 4963-1] openssl security update

• OpenSSL: Multiple Vulnerabilities (GLSA 202210-02) — Gentoo security

• OpenSSL Security Advisory [24 August 2021] (1)