CVE-2023-5678

What it actually does

The flaw permits supply of excessively long X9.42 DH parameters or keys to DH_generate_key(), DH_check_pub_key(), DH_check_pub_key_ex(), EVP_PKEY_public_check() or EVP_PKEY_generate(), causing unbounded computation time without adequate size validation on P and Q values.

Why it matters to the business

Services relying on OpenSSL DH operations may experience prolonged unresponsiveness or CPU exhaustion when handling untrusted inputs, interrupting availability of affected cryptographic workflows until the software is updated.

How an attack unfolds

An attacker supplies crafted, oversized X9.42 DH keys or parameters obtained from an untrusted source to any application or command-line tool invoking the vulnerable OpenSSL functions; the absence of early length checks on P and Q triggers expensive modular arithmetic, resulting in denial of service. No named threat actors or ransomware campaigns are associated with this issue.

How to fix it

Upgrade openssl to the version containing commit 85cf92f55d9e2ac5aacf92bedd33fb890b9f8b4c and update stackrox to commit 8b9ebeef657ee230d735661d7ebd9fd52f61833d. Replace calls to the affected functions with safe alternatives or ensure all inputs are validated for reasonable parameter sizes before processing.

How to confirm the fix worked

Confirm the installed OpenSSL binary or library reports a build that includes commit 85cf92f55d9e2ac5aacf92bedd33fb890b9f8b4c; execute timing tests using large synthetic X9.42 parameters to verify absence of excessive delays; review source for remaining direct calls to the vulnerable APIs.

Typical attack path

1. Locate an application or CLI invocation that calls DH_generate_key() or DH_check_pub_key() on externally supplied data
2. Generate or obtain an X9.42 DH parameter set containing excessively large P or Q values
3. Submit the malicious parameters through the affected interface
4. Observe sustained high CPU usage and delayed response leading to service degradation

How to detect it

Search process accounting or application logs for unusually long execution times inside DH key or parameter validation routines; correlate with inbound network flows carrying DH parameters; monitor for spikes in CPU attributed to OpenSSL worker processes.

What your security team should do

• Apply the listed fixed commits to all OpenSSL and stackrox deployments within standard change windows
• Inventory code and configurations that invoke DH key generation or public-key checks on untrusted data
• Implement input-size sanity checks or rate limiting around cryptographic parameter handling as a temporary control