CVE-2022-2274

RSA implementation bug in AVX512IFMA instructions

The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect on such machines and memory corruption will happen during the computation. As a consequence of the memory corruption an attacker may be able to trigger a remote code execution on the machine performing the computation. SSL/TLS servers or other servers using 2048 bit RSA private keys running on machines supporting AVX512IFMA instructions of the X86_64 architecture are affected by this issue.

We have discovered 373,969 live websites that are affected by CVE-2022-2274.

Run a Free Instant Scan



Affected Software

Product  OpenSSL
Category Web Server Extensions
Vulnerable Domains373,969 live websites (76% of OpenSSL install base)
Vulnerable Versions
  • from 0 through 3.0.4
Vulnerable Versions Count18 versions ( 25% of all versions)



Details

  • Published - Jul 1, 2022
  • Updated - Sep 17, 2024

Website Distribution by Country

Number of websites using CVE-2022-2274
United States97,884 websites


Japan36,401 websites
Germany23,171 websites
Netherlands18,439 websites
Czech Republic14,291 websites
Korea, South14,156 websites
China13,185 websites
Russia12,828 websites
France12,170 websites

Website Distribution by TLD

Number of websites using CVE-2022-2274
.com143,244 websites
.org17,269 websites
.net17,140 websites
.nl13,944 websites
.de13,180 websites
.cz11,628 websites
.ru11,172 websites
.jp10,675 websites
.it7,947 websites
.edu5,429 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2022-2274

Top websites that are affected by CVE-2022-2274. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*****.cz Czech Republic*,***
****.com United States*,***
********.com United States*,***
*.******.***.***.br Brazil*,***
*.*****.***.***.br Brazil*,***
******.********.***.uk GB*,***
**.***.edu United States*,***
***********************.com United States*,***
****.**.com United States*,***
***.***.edu United States*,***
See full domain list

FAQ

A total of 373,969 websites have been identified as vulnerable to CVE-2022-2274, based on global website indexing conducted by WebTechSurvey.
The OpenSSL is affected by the CVE-2022-2274 vulnerability.
OpenSSL versions up to and including 3.0.4 are vulnerable to CVE-2022-2274.