Problem Description:
Invoking SSL_read()/SSL_write() while in an error state
causes data to be passed without being decrypted/encrypted
directly from the SSL/TLS record layer.
In order to exploit this issue an application bug would
have to be present that resulted in a call to
SSL_read()/SSL_write() being issued after having already
received a fatal error. [CVE-2017-3737]
There is an overflow bug in the x86_64 Montgomery
multiplication procedure used in exponentiation with 1024-bit
moduli. This only affects processors that support the AVX2
but not ADX extensions like Intel Haswell (4th generation).
[CVE-2017-3738] This bug only affects FreeBSD 11.x.
Impact:
Applications with incorrect error handling may inappropriately
pass unencrypted data. [CVE-2017-3737]
Mishandling of carry propagation will produce incorrect
output, and make it easier for a remote attacker to obtain
sensitive private-key information. No EC algorithms are
affected and analysis suggests that attacks against RSA and
DSA as a result of this defect would be very difficult to
perform and are not believed likely.
Attacks against DH1024 are considered just feasible
(although very difficult) because most of the work necessary
to deduce information about a private key may be performed
offline. The amount of resources required for such an attack
would be very significant and likely only accessible to a
limited number of attackers. However, for an attack on TLS
to be meaningful, the server would have to share the DH1024
private key among multiple clients, which is no longer an
option since CVE-2016-0701. [CVE-2017-3738]