CVE-2022-2274

critical

The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions.

Vendor / product: Openssl — openssl

The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect on such machines and memory corruption will happen during the computation. As a consequence of the memory corruption an attacker may be able to trigger a remote code execution on the machine performing the computation. SSL/TLS servers or other servers using 2048 bit RSA private keys running on machines supporting AVX512IFMA instructions of the X86_64 architecture are affected by this issue.

CVSS

9.8

9.8 (CVSS v3.1)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity source: NVD CVSS v3.1 (nvd@nist.gov)

Timeline (UTC)

Published: 2022-07-01 08:15

Modified: 2026-10-14 13:17

NVD status: Modified

Last synced 2 days ago

Verified against the source API 2026-10-27 07:06 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

openssl / openssl 3.0.4

netapp / snapcenter all versions

netapp / h410c_firmware all versions

netapp / h300s_firmware all versions

netapp / h500s_firmware all versions

netapp / h700s_firmware all versions

netapp / h410s_firmware all versions

Weakness classification (CWE)

CWE-787

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://www.openssl.org/news/secadv/20220705.txt

References

https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=4d8a88c134df634ba610ff8db... openssl-security@openssl.org
https://github.com/openssl/openssl/issues/18625 openssl-security@openssl.org
https://security.netapp.com/advisory/ntap-20220715-0010/ openssl-security@openssl.org
https://www.openssl.org/news/secadv/20220705.txt openssl-security@openssl.org
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=4d8a88c134df634ba610ff8db... af854a3a-2127-422b-91ae-364da2661108
https://github.com/openssl/openssl/issues/18625 af854a3a-2127-422b-91ae-364da2661108
https://security.netapp.com/advisory/ntap-20220715-0010/ af854a3a-2127-422b-91ae-364da2661108
https://www.openssl.org/news/secadv/20220705.txt af854a3a-2127-422b-91ae-364da2661108
https://cert-portal.siemens.com/productcert/html/ssa-332410.html 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
https://cert-portal.siemens.com/productcert/html/ssa-398330.html 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
https://cert-portal.siemens.com/productcert/html/ssa-794697.html 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 07:06 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

CVE-2022-2274

Affected products

Weakness classification (CWE)

Mitigation & advisories

References

Data sources

Learn the basics

Related CVEs