GSD-2022-2274

In OpenSSL version 3.0.4 a heap buffer overflow exists in the AVX512 support that can be attacked via network resulting in code execution. This is reachable via four code paths: RSAZ 1024, RSAZ 512, Dual 1024 RSAZ, and Default constant-time Montgomery modular exponentiation. Please note this issue is especially serious as OpenSSL 3.0.4 contains a security fix for CVE-2022-2068 which allows arbitrary code execution. This means that all users of OpenSSL 3 are affected by a number of serious security vulnerabilities. Intel AXV-512 support is present in Intel CPUs releases including Knights Landing (Xeon Phi x200, 2016), Knights Mill (Xeon Phi x205, 2017), Skylake-SP, Skylake-X (2017), Cannon Lake (2018), Cascade Lake (2019), Cooper Lake (2020), Ice Lake (2019), Tiger Lake (2020), Rocket Lake (2021). Please note that on Alder Lake (2021) AVX-512 is not officially supported, but can be enabled on some motherboards with some BIOS versions. For AMD all Zen4 CPUs contain AVX-512 support. Please note that this was previously assigned GSD-2022-1002526 but we have updated the ID to reflect the assignment of the CVE.