SM2 Decryption Buffer Overflow
Priority CRITICAL 91CWE-120Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-120 and the CVSS impact.
Summary
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k).
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.87816 99th percentileScored 2026-11-07
Fix Partial openssl-src (crates.io): 111.16.0Red Hat: 1 advisoryRed Hat: 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OpenSSL | OpenSSL | Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k) | — | No fix listed | CNA |
| — | openssl-src (crates.io) | before 111.16.0 | 111.16.0 | Patch available | GHSA-5ww6-px42-wc85 |
- OpenSSL VendorOpenSSL Affected Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k) Fixed in — No fix listed CNA
- openssl-src (crates.io) Vendor— Affected before 111.16.0 Fixed in 111.16.0 Patch available GHSA-5ww6-px42-wc85
CPE configurations NVD · 40
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* | 1.1.1 to before 1.1.1l | Vulnerable | OpenSSL |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* | 11.0 – 11.50.2 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:manageability_software_development_kit:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* Versions 1.1.1 to before 1.1.1l Vulnerable ·OpenSSL
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* Versions 11.0 – 11.50.2 Vulnerable ·NetApp
- cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:manageability_software_development_kit:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Show 30 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:santricity_smi-s_provider:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:storage_encryption:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.7.0:*:*:*:*:*:*:* | 1.7.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.15.0:*:*:*:*:*:*:* | 1.15.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_session_border_controller:8.4:*:*:*:*:*:*:* | 8.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_session_border_controller:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_unified_session_manager:8.2.5:*:*:*:*:*:*:* | 8.2.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_unified_session_manager:8.4.5:*:*:*:*:*:*:* | 8.4.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_communications_broker:3.2.0:*:*:*:*:*:*:* | 3.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_communications_broker:3.3.0:*:*:*:*:*:*:* | 3.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_session_border_controller:8.4:*:*:*:*:*:*:* | 8.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_session_border_controller:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:essbase:*:*:*:*:*:*:*:* | before 11.1.2.4.47; 21.1 to before 21.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:health_sciences_inform_publisher:6.2.1.1:*:*:*:*:*:*:* | 6.2.1.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:health_sciences_inform_publisher:6.3.1.1:*:*:*:*:*:*:* | 6.3.1.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* | before 9.2.6.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:jd_edwards_world_security:a9.4:*:*:*:*:*:*:* | a9.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:mysql_connectors:*:*:*:*:*:*:*:* | up to 8.0.27 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* | up to 8.0.25 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* | 5.7.0 – 5.7.35; 8.0.0 – 8.0.26 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* | 8.57 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* | 8.58 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* | 8.59 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:* | 8.8 | Vulnerable | Oracle |
| cpe:2.3:a:tenable:nessus_network_monitor:*:*:*:*:*:*:*:* | up to 5.13.1 | Vulnerable | Tenable |
| cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:* | 5.16.0 – 5.19.1 | Vulnerable | Tenable |
- cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:santricity_smi-s_provider:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:storage_encryption:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.7.0:*:*:*:*:*:*:* Versions 1.7.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.15.0:*:*:*:*:*:*:* Versions 1.15.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_session_border_controller:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_session_border_controller:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_unified_session_manager:8.2.5:*:*:*:*:*:*:* Versions 8.2.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_unified_session_manager:8.4.5:*:*:*:*:*:*:* Versions 8.4.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_communications_broker:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_communications_broker:3.3.0:*:*:*:*:*:*:* Versions 3.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_session_border_controller:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_session_border_controller:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:essbase:*:*:*:*:*:*:*:* Versions before 11.1.2.4.47; 21.1 to before 21.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:health_sciences_inform_publisher:6.2.1.1:*:*:*:*:*:*:* Versions 6.2.1.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:health_sciences_inform_publisher:6.3.1.1:*:*:*:*:*:*:* Versions 6.3.1.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* Versions before 9.2.6.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:jd_edwards_world_security:a9.4:*:*:*:*:*:*:* Versions a9.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:mysql_connectors:*:*:*:*:*:*:*:* Versions up to 8.0.27 Vulnerable ·Oracle
- cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* Versions up to 8.0.25 Vulnerable ·Oracle
- cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* Versions 5.7.0 – 5.7.35; 8.0.0 – 8.0.26 Vulnerable ·Oracle
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* Versions 8.57 Vulnerable ·Oracle
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* Versions 8.58 Vulnerable ·Oracle
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* Versions 8.59 Vulnerable ·Oracle
- cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:* Versions 8.8 Vulnerable ·Oracle
- cpe:2.3:a:tenable:nessus_network_monitor:*:*:*:*:*:*:*:* Versions up to 5.13.1 Vulnerable ·Tenable
- cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:* Versions 5.16.0 – 5.19.1 Vulnerable ·Tenable
Remediation
- Fix · GHSA-5ww6-px42-wc85 openssl-src (crates.io) Fixed in 111.16.0 Advisory →
Red Hat 1 advisory
- RHSA-2021:4618 Released 2021-11-11 · Red Hat rating ImportantRed Hat Advanced Cluster Management 2.4 images and security updates
- Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle +47
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
OpenSSL — DSA-4963
2 records Highest priority Priority CRITICAL 1 CRITICAL, 1 MEDIUM
Other records, highest priority first
- TI-2021-02646 Read buffer overruns processing ASN.1 stringsPriority MEDIUM 63
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
Not affected: 8 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat JBoss Core Services
- Red Hat JBoss Web Server 3
- Red Hat JBoss Web Server 5
- Red Hat Virtualization 4
Timeline
- 2026-10-02 Threatist record created from CVE-2021-3711
- 2026-10-03 Alias added: GHSA-5ww6-px42-wc85
- 2026-10-08 CISA SSVC decision points changed
- 2026-10-09 Priority changed: HIGH → CRITICAL
References
Patch 3
Advisory 11
- https://www.openssl.org/news/secadv/20210824.txt
- DSA-4963
- [oss-security] 20210825 OpenSSL SM2 Decryption Buffer Overflow (CVE-2021-3711), Read buffer overruns processing ASN.1 strings (CVE-2021-3712)
- https://security.netapp.com/advisory/ntap-20210827-0010/
- https://www.tenable.com/security/tns-2021-16
- https://security.netapp.com/advisory/ntap-20211022-0003/
- https://www.tenable.com/security/tns-2022-02
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- GLSA-202209-02
- GLSA-202210-02
- https://nvd.nist.gov/vuln/detail/CVE-2021-3711
Other 11
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=59f5e75f3bced8fc0e130d72a3f582cf7b480b46
- [tomcat-dev] 20210825 OpenSSL security announcement - do we need a Tomcat Native release?
- [tomcat-dev] 20210826 Re: OpenSSL security announcement - do we need a Tomcat Native release?
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://security.netapp.com/advisory/ntap-20240621-0006
- https://security.netapp.com/advisory/ntap-20211022-0003
- https://security.netapp.com/advisory/ntap-20210827-0010
- https://rustsec.org/advisories/RUSTSEC-2021-0097.html
- https://lists.apache.org/thread.html/rad5d9f83f0d11fb3f8bb148d179b8a9ad7c6a17f18d70e5805a713d1@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r18995de860f0e63635f3008fd2a6aca82394249476d21691e7c59c9e@%3Cdev.tomcat.apache.org%3E
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=59f5e75f3bced8fc0e130d72a3f582cf7b480b46
More Openssl vulnerabilities
- TI-2022-01915 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
- TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
- TI-2022-01176 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
- TI-2014-00154 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly… KEVCVSS 3.1HIGH 7.5
- TI-2025-14107 Stack buffer overflow in CMS (Auth)EnvelopedData parsing CVSS 3.1HIGH 8.8
- TI-2003-00513 Double free vulnerability in OpenSSL 0.9.7 allows remote attackers to cause a denial of… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2021-3711 · CVE Program
- CVE-2021-3711 · NVD
- FIRST EPSS
- GHSA-5ww6-px42-wc85 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-3711 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences