Link Copied
Hi I'm having the same issue, Microsoft 365 Defender is reporting the same issue. See the attached screenshot.
1. What is the brand and model name of your processor?
Intel(R) Core(TM) i5-10210U CPU @ 1.60GHz
2. What is the brand and model name of your motherboard (if desktop) or laptop and its BIOS version?
Model NUC10i5FNH, Bios FNCML357.0058.2022.0720.1011
3. What is the Windows version and build?
Microsoft Windows 10 Enterprise - 10.0.19045
Hi
I've allows seen this issue,
Nothing to do with Motherboard or bios or Processor
issue is the Driver software is using OpenSSL and
So, Intel WHEN you are going to update your Driver software to patch this issue ?
see below
Executive summary
On October 25, 2022, OpenSSL announced the release of OpenSSL version 3.0.7, which will address a critical security issue. OpenSSL version 3.0.7 became generally available on November 1st 2022. The security issue has since been downgraded from a Critical rating to a High severity rating.
The vulnerability is a denial-of-service for systems that support client certificate-based authentication. An attacker could send a maliciously crafted certificate to a server that parses certificates as part of client authentication and crash the server. At the time of this report, the vulnerability does not appear to allow Remote Code Execution (RCE), however OpenSSL states in their advisory that since their codebase is distributed as source code, some product implementations might have implemented the code in such a way that RCE could be triggered on some platforms. However they do state that exposure to remote code execution is not expected on any platforms.
The only known mitigation at the time of this report is to upgrade to OpenSSL version 3.0.7. Customers can track their exposure and patching status once the patch and CVE are released using Microsoft Defender Vulnerability Management, by navigating to the Endpoints Exposure tab of the report.
For more information about impacted Microsoft products, please see the following MSRC blog.
Analysis
The denial-of-service (DoS) vulnerability stems from a buffer overflow which can be triggered in name constraint checking when OpenSSL does X.509 certificate validation. The buffer overflow occurs after certificate chain validation and require a Certificate Authority to sign a malicious certificate, – which is not unlikely – or for an application to continue certificate validation, despite failing to construct a certificate chain to a trusted issuer.
Attackers exploit the vulnerability by crafting a malicious email address containing the '.' character in the X.509 certificate to cause an overflow of an arbitrary number of bytes. This could result in a crash and cause a Denial of Service.
This impacts both TLS clients and servers. For a client, the vulnerability could be triggered by connecting to a malicious server. For a server, it can be triggered if the server requests client certificate authentication and a client with a maliciously configured certificate connects to the server.
Mitigation
Apply the following mitigation to reduce the impact of this threat. Check the recommendations card for the deployment status of monitored mitigations.
Upgrade to OpenSSL version 3.0.7 as soon as it is available
Reference
Attack Surface: CVE-2022-3602 - OpenSSL 3 Buffer Overflow on Certificate Validation of Email Address . Microsoft Defender Threat Intelligence (accessed 11-01-2022)
CVE-2022-3786 and CVE-2022-3602: X.509 Email Address Buffer Overflows. OpenSSL.org (accessed 11-01-2022)
OpenSSL version 3.0.7 published. OpenSSL.org (accessed 11-01-2022)
https://www.openssl.org/news/secadv/20221101.txt. OpenSSL.org (accessed 11-01-2022)
Forthcoming OpenSSL Releases. OpenSSL.org (accessed 10-31-2022)
Change log
2022-11-01 16:55 UTC | Updated vulnerability details
2022-10-31 19:00 UTC | Entry created
Copyright
© Microsoft 2022. All rights reserved. Reproduction or distribution of the content of this site, or any part thereof, without written permission of Microsoft is prohibited.
