CVE-2021-23840

What it actually does

This is an integer overflow/incorrect length handling flaw in OpenSSL cipher update routines. Calls to EVP_CipherUpdate, EVP_EncryptUpdate, or EVP_DecryptUpdate with an input length near the platform integer maximum can return success while setting the output length to a negative value. Applications that trust that output length may mis-handle buffers, enter error paths incorrectly, or crash. The practical impact is primarily denial of service against software that exposes OpenSSL encryption/decryption processing to attacker-controlled, very large inputs. OpenSSL 1.1.1 through 1.1.1i and 1.0.2 through 1.0.2x are affected; OpenSSL 1.1.1j and 1.0.2y contain fixes. The provided affected downstream product data indicates mysql/mysql-server source dependencies were patched in commits e5d189ecb9465f4be6235109dd3dbcaab01ddc53 and 7ed30a748964c009d4909cb8b4b22036ebdef239.

Why it matters to the business

Successful exploitation can crash applications or services that rely on affected OpenSSL versions, causing outages, failed encrypted communications, interrupted database or application workflows, and possible cascading service instability. The issue is old and not listed in CISA KEV, and no mature public exploit is indicated, but the EPSS score is relatively elevated and stable, so internet-facing or high-throughput services using vulnerable OpenSSL builds should still be remediated as a priority availability risk.

How an attack unfolds

An attacker first identifies a reachable service or application that uses a vulnerable OpenSSL library and accepts attacker-controlled encrypted or decryptable input. The attacker then sends a specially large input that drives EVP_CipherUpdate, EVP_EncryptUpdate, or EVP_DecryptUpdate toward the maximum supported integer length on the target platform. In the vulnerable implementation, the OpenSSL call may report success while returning a negative output length. If the calling application assumes the operation succeeded and uses that invalid length in subsequent logic, it may trigger incorrect buffer handling, failed assertions, memory allocation errors, or a process crash. The expected attacker outcome is denial of service rather than code execution or data theft.

How to fix it

Upgrade affected OpenSSL deployments to a fixed release: OpenSSL 1.1.1j or later for the 1.1.1 branch, and OpenSSL 1.0.2y for organizations with premium 1.0.2 support. Because OpenSSL 1.0.2 is otherwise end-of-life, unsupported users should migrate to a supported OpenSSL branch rather than remaining on 1.0.2. Rebuild or redeploy statically linked applications and container images because updating the operating-system package alone may not update bundled OpenSSL copies. For mysql/mysql-server source builds, ensure downstream code includes the fixed commits e5d189ecb9465f4be6235109dd3dbcaab01ddc53 and 7ed30a748964c009d4909cb8b4b22036ebdef239 or a later vendor release containing those changes. If immediate patching is not possible, reduce exposure by limiting unauthenticated access to affected services, applying request/body size limits, rate limiting large encrypted payloads, and isolating services that perform bulk cryptographic processing.

How to confirm the fix worked

Confirm the OpenSSL runtime version used by each application, not only the system package version. Use commands such as openssl version -a, package manager inventory, container image inspection, and software composition analysis to find OpenSSL 1.1.1 through 1.1.1i or 1.0.2 through 1.0.2x. For dynamically linked binaries, verify linked libraries with tools such as ldd, otool, or equivalent platform utilities. For statically linked software, confirm build manifests or binary fingerprints because the vulnerable code may be embedded. Validate that mysql/mysql-server source trees or packaged releases include commits e5d189ecb9465f4be6235109dd3dbcaab01ddc53 and 7ed30a748964c009d4909cb8b4b22036ebdef239, or a later release from the vendor. After remediation, restart affected processes and confirm they load the fixed OpenSSL library. Where safe and authorized, perform negative testing with oversized encrypted/decrypted inputs in a non-production environment and verify the service rejects the input without crashing.

Typical attack path

1. Identify services, applications, or embedded components linked against OpenSSL 1.1.1 through 1.1.1i or OpenSSL 1.0.2 through 1.0.2x.
2. Determine whether the service processes attacker-controlled bulk encrypted or decrypted content through OpenSSL EVP cipher update APIs.
3. Send an unusually large crafted input designed to approach platform integer length limits during encryption or decryption processing.
4. Trigger an integer overflow in the output length calculation while the OpenSSL API still returns success.
5. Cause the application to mis-handle the negative output length, resulting in application errors, abnormal termination, or service unavailability.

How to detect it

There is no reliable universal network indicator for exploitation because triggering inputs are application-specific and the primary outcome is a crash or abnormal application behavior. Review application logs, service manager logs, core dumps, crash reports, endpoint telemetry, and reverse proxy or load balancer logs for unexplained process terminations correlated with very large requests, uploads, encrypted payloads, or repeated connection attempts. Look for crashes in processes linked to vulnerable OpenSSL versions, especially stack traces referencing EVP_CipherUpdate, EVP_EncryptUpdate, or EVP_DecryptUpdate. On Linux, inspect syslog, journald, kernel OOM/crash messages, coredumpctl, and application-specific error logs. On Windows, review Application Event Log, Windows Error Reporting artifacts, service control manager restart events, and application crash dumps. For database or server products that embed OpenSSL, correlate service restarts with client sessions transferring unusually large packets or blobs. Treat evidence as suspicious when repeated crashes occur shortly after large unauthenticated or low-privilege network inputs, even if no known exploit tool is observed.

• EVP_CipherUpdate
• EVP_EncryptUpdate
• EVP_DecryptUpdate
• OpenSSL 1.1.1i
• OpenSSL 1.1.1h
• OpenSSL 1.1.1g
• OpenSSL 1.1.1f
• OpenSSL 1.1.1e
• OpenSSL 1.1.1d
• OpenSSL 1.1.1c
• OpenSSL 1.1.1b
• OpenSSL 1.1.1a
• OpenSSL 1.1.1
• OpenSSL 1.0.2x
• OpenSSL 1.0.2w
• OpenSSL 1.0.2v
• OpenSSL 1.0.2u
• OpenSSL 1.0.2t
• OpenSSL 1.0.2s
• OpenSSL 1.0.2r
• OpenSSL 1.0.2q
• OpenSSL 1.0.2p
• OpenSSL 1.0.2o
• OpenSSL 1.0.2n
• OpenSSL 1.0.2m
• OpenSSL 1.0.2l
• OpenSSL 1.0.2k
• OpenSSL 1.0.2j
• OpenSSL 1.0.2i
• OpenSSL 1.0.2h
• OpenSSL 1.0.2g
• OpenSSL 1.0.2f
• OpenSSL 1.0.2e
• OpenSSL 1.0.2d
• OpenSSL 1.0.2c
• OpenSSL 1.0.2b
• OpenSSL 1.0.2a
• OpenSSL 1.0.2
• core dumped
• segmentation fault
• SIGSEGV
• SIGABRT
• application error
• service terminated unexpectedly
• e5d189ecb9465f4be6235109dd3dbcaab01ddc53
• 7ed30a748964c009d4909cb8b4b22036ebdef239

What your security team should do

• Inventory all OpenSSL instances, including containers, appliances, statically linked binaries, and third-party products that may embed OpenSSL.
• Prioritize remediation for internet-facing services, authentication gateways, database services, message brokers, file transfer systems, and any application that processes large encrypted payloads.
• Upgrade OpenSSL 1.1.1 deployments to 1.1.1j or later, and migrate unsupported OpenSSL 1.0.2 deployments to a supported branch unless covered by vendor premium support with 1.0.2y available.
• For mysql/mysql-server builds, move to a vendor release or source revision containing commits e5d189ecb9465f4be6235109dd3dbcaab01ddc53 and 7ed30a748964c009d4909cb8b4b22036ebdef239.
• Rebuild and redeploy applications that statically link OpenSSL; do not assume operating-system patching remediates embedded libraries.
• Apply compensating controls such as maximum request size limits, connection throttling, and access restrictions for services that cannot be patched immediately.
• Monitor for unexplained crashes or restarts of OpenSSL-linked services, especially following unusually large inbound encrypted requests or file processing events.