The version of hvloader / openssl installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-9143 advisory.

  - Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial     can lead to out-of-bounds memory reads or writes. (CVE-2024-9143)

  - Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the     field polynomial can lead to out-of-bounds memory reads or writes. Impact summary: Out of bound memory     writes can lead to an application crash or even a possibility of a remote code execution, however, in all     the protocols involving Elliptic Curve Cryptography that we're aware of, either only named curves are     supported, or, if explicit curve parameters are supported, they specify an X9.62 encoding of binary     (GF(2^m)) curves that can't represent problematic input values. Thus the likelihood of existence of a     vulnerable application is low. In particular, the X9.62 encoding is used for ECC keys in X.509     certificates, so problematic inputs cannot occur in the context of processing X.509 certificates. Any     problematic use-cases would have to be using an exotic curve encoding. The affected APIs include:
    EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(), and various supporting BN_GF2m_*() functions.
    Applications working with exotic explicit binary (GF(2^m)) curve parameters, that make it possible to     represent invalid field polynomials with a zero constant term, via the above or similar APIs, may     terminate abruptly as a result of reading or writing outside of array bounds. Remote code execution cannot     easily be ruled out. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.
    (CVE-2024-9143)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Azure Linux 3.0 Security Update: hvloader / openssl (CVE-2024-9143)

high Nessus Plugin ID 233062

Version 1.2

Version 1.1

Version 1.2 May 23, 2025, 4:39 PM IAVM reference Plugin Feed: 202505231639
Version 1.1 Mar 21, 2025, 4:46 AM New Plugin Feed: 202503210446