cannot repro

[bwolmarans]

[huolong1992]

me too ! My openssl version is 1.1.1d
But after I upgrade to version 1.1.1n, it will trigger an infinite loop

[frakman1]

@huolong1992 huolong1992

That's strange because I am using openssl 1.1.1d on my Pi as well and it hangs forever when I run it:

pi@bridge:~/git/CVE-2022-0778 $ openssl version
OpenSSL 1.1.1d  10 Sep 2019
pi@bridge:~/git/CVE-2022-0778 $ ./my_bad_sqrt
p = 697
a = 696
^C

[drago-96]

It really depends on the distribution's package manager...

For example, on Ubuntu 20 the OpenSSL version is named "1.1.1f", but has several minor revisions by mantainers, and in particular the latest one patches this vulnerability.

@bwolmarans you can try to downgrade the OpenSSL package with apt install openssl=1.1.1f-1ubuntu2.11 if you want to reproduce this.