CVE-2023-0286: Type confusion in OpenSSL GENERAL_NAME_cmp for X.400 addresses — ASN1_STRING* parsed but treated as ASN1_TYPE*

CVE-2023-0286 is a type confusion vulnerability in OpenSSL 3.0.7 (and earlier) affecting X.509 GeneralName processing of X.400 addresses.

The bug: In crypto/x509/v3_genn.c, the ASN1 template at line 37 parses GENERAL_NAME.d.x400Address (type tag GEN_X400) using ASN1_SEQUENCE, which stores the value as an opaque ASN1_STRING * (raw DER bytes of the sequence). However, the public header include/openssl/x509v3.h.in declares d.x400Address as ASN1_TYPE *.

When GENERAL_NAME_cmp() (line 93-131) handles the GEN_X400 case, it calls ASN1_TYPE_cmp(a->d.x400Address, b->d.x400Address) — treating what is actually an ASN1_STRING * as an ASN1_TYPE *.

The struct layout mismatch on 64-bit systems:

• ASN1_STRING.length (offset +0, 4 bytes) is read as ASN1_TYPE.type
• ASN1_STRING.data pointer (offset +8, 8 bytes) is read as ASN1_TYPE.value.ptr

ASN1_TYPE_cmp then calls ASN1_STRING_cmp() with what it thinks is a value.ptr, but is actually the data pointer of the raw DER bytes. This allows an attacker-controlled X.400 DER content to pass arbitrary pointers to memcmp, enabling memory read (info disclosure) or DoS via NULL deref.

Triggered when CRL checking is enabled (X509_V_FLAG_CRL_CHECK) and a cert/CRL contains a GEN_X400 GeneralName in a CRL Distribution Point, causing GENERAL_NAME_cmp to be called via x509_vfy.c:1421.