CVE-2022-4991: Tychon OpenSSL Privilege Escalation Vulnerability

Technical summary

CVE-2022-4991 stems from improper handling of the OPENSSLDIR variable within Tychon's bundled OpenSSL component. The vulnerability arises because OPENSSLDIR is configured to reference a subdirectory that may be writable by unprivileged users on Windows systems. When Tychon's privileged service (running under SYSTEM context) initializes OpenSSL, it loads configuration from openssl.cnf at a predictable path. An attacker who controls write access to this directory can craft a malicious openssl.cnf file to execute arbitrary code when the service loads the configuration. The CVSS 3.1 vector (7.4 HIGH) reflects the requirement for local access and the complexity of crafting a suitable configuration payload, but acknowledges the severe impact of code execution at SYSTEM privilege level.

Business impact

Successful exploitation enables complete system compromise by an authenticated local user, potentially leading to data theft, lateral movement within the network, installation of persistent backdoors, or denial of service. Organizations running Tychon on Windows systems must assume that any local user account—including service accounts with minimal privileges—could escalate to administrative control. This is particularly concerning in shared or multi-user environments, and in systems where Tychon runs as a privileged service handling sensitive operations.

Affected systems

Tychon on Windows platforms is affected. The vulnerability requires an unprivileged user to have filesystem write access to the directory specified by OPENSSLDIR within Tychon's OpenSSL configuration. Verify the specific Tychon versions impacted and patch availability from the vendor advisory, as version information is not specified in the initial disclosure.

Exploitability

Exploitation requires local system access and the ability to write files to the OPENSSLDIR location. It is not remotely exploitable over a network. However, the attack surface is broad in environments where Tychon is deployed on systems accessible to multiple user accounts, or where local privilege escalation is a known attack chain. The complexity rating reflects the need to craft a valid openssl.cnf payload, but this is straightforward for an attacker with basic understanding of OpenSSL configuration syntax. The vulnerability is not currently tracked on CISA's Known Exploited Vulnerabilities list.

Remediation

Apply the security patch from the Tychon vendor as soon as it becomes available. The fix should address either the incorrect OPENSSLDIR path specification or the privilege model of the vulnerable service. In the interim, restrict write permissions on the OPENSSLDIR-related directories to only SYSTEM and trusted administrative accounts. Review local user accounts and access controls to limit the number of users who can write to sensitive filesystem locations.

Patch guidance

Consult the Tychon vendor advisory for the specific patched version number and deployment procedures. Apply patches to all Windows systems running Tychon, prioritizing those in multi-user environments or where the service handles sensitive data. After patching, verify that OpenSSL configuration paths are no longer world-writable or user-writable, and confirm that the service restarts cleanly with the updated binaries.

Detection guidance

Monitor for suspicious modifications to openssl.cnf files in Tychon's installation directory or related OpenSSL configuration paths. Alert on any attempt by unprivileged processes to write to these locations. Check Windows event logs for unusual service restarts or SYSTEM-privilege code execution initiated from atypical locations. Use filesystem integrity monitoring to detect unauthorized changes to OpenSSL configuration files. Endpoint Detection and Response (EDR) tools should flag attempts to place specially-crafted configuration files in predictable OpenSSL directories.

Why prioritize this

Although not yet on the KEV list and requiring local access, this vulnerability merits rapid patching due to its HIGH CVSS score, the universal availability of local access in multi-user systems, and the severe impact of SYSTEM-level code execution. Organizations should treat this as a high-priority remediation target, particularly for systems in sensitive environments or those handling privileged operations.

Risk score, explained

The CVSS 3.1 score of 7.4 (HIGH) reflects a vulnerability that demands either local access or a pre-existing foothold, yet delivers critical impact—arbitrary code execution at the highest Windows privilege level. The attack complexity is rated as high due to the need to craft a valid OpenSSL configuration, but this should not be misinterpreted as difficult; the rating reflects the technical steps required, not the likelihood that an attacker will succeed once local access is obtained.

Frequently asked questions