OpenSSL: CVE-2021-3711 SM2 Decryption Buffer Overflow

In order to decrypt SM2 encrypted data an application is expected to callthe API function EVP_PKEY_decrypt(). Typically an application will callthis function twice. The first time, on entry, the "out" parameter can beNULL and, on exit, the "outlen" parameter is populated with the buffer sizerequired to hold the decrypted plaintext. The application can then allocatea sufficiently sized buffer and call EVP_PKEY_decrypt() again, but thistime passing a non-NULL value for the "out" parameter. A bug in theimplementation of the SM2 decryption code means that the calculation of thebuffer size required to hold the plaintext returned by the first call toEVP_PKEY_decrypt() can be smaller than the actual size required by thesecond call. This can lead to a buffer overflow when EVP_PKEY_decrypt() iscalled by the application a second time with a buffer that is too small. Amalicious attacker who is able present SM2 content for decryption to anapplication could cause attacker chosen data to overflow the buffer by upto a maximum of 62 bytes altering the contents of other data held after thebuffer, possibly changing application behaviour or causing the applicationto crash. The location of the buffer is application dependent but istypically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k).

Where it's fixed