A critical vulnerability (CVE-2022-3515) has been identified in the LibKSBA library, developed by the GnuPG project and providing functions for working with X.509 certificates. This vulnerability leads to an integer overflow and the writing of arbitrary data beyond the allocated buffer when parsing ASN.1 structures used in S/MIME, X.509, and CMS. The problem is exacerbated by the fact that the Libksba library is used in the GnuPG package, and the vulnerability may allow for remote code execution by an attacker when processing encrypted or signed data from files or emails using S/MIME in GnuPG (gpgsm). In the simplest case, to attack a victim using a mail client that supports GnuPG and S/MIME, it is sufficient to send a specially crafted email.
The vulnerability can also be exploited to attack dirmngr servers that handle the downloading and parsing of Certificate Revocation Lists (CRLs) and the verification of certificates used in TLS. The attack on dirmngr could be executed from a server controlled by an attacker through the delivery of specially crafted CRLs or certificates. web server, controlled by an attacker, via the delivery of specially crafted CRLs or certificates. It is noted that there are currently no publicly available exploits for gpgsm and dirmngr, but the vulnerability is typical, and nothing prevents skilled attackers from preparing their own exploit.
The vulnerability has been fixed in Libksba version 1.6.2 and in GnuPG binary releases 2.3.8. In Linux distributions, the Libksba library is typically provided as a separate dependency, while in Windows builds, it is included in the main installation package with GnuPG. After updating, be sure to restart background processes with the command "gpgconf —kill all". To check for the presence of the issue, you can assess the value of the "KSBA ...." line in the output of the "gpgconf —show-versions" command, which should indicate a version of at least 1.6.2.
Updates for distributions have not yet been released, but you can monitor their appearance on the pages: Debian, Ubuntu, Gentoo, RHEL, SUSE, Arch, FreeBSD. The vulnerability is also present in the MSI and AppImage packages with GnuPG VS-Desktop and in Gpg4win.
Source: opennet.ru
