OpenSSL Security Advisory
tomas at openssl.org
Thu Apr 20 16:05:09 UTC 2023
-----BEGIN PGP SIGNED MESSAGE-----
OpenSSL Security Advisory [20th April 2023]
Input buffer over-read in AES-XTS implementation on 64 bit ARM (CVE-2023-1255)
Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM
platform contains a bug that could cause it to read past the input buffer,
leading to a crash.
Impact summary: Applications that use the AES-XTS algorithm on the 64 bit ARM
platform can crash in rare circumstances. The AES-XTS algorithm is usually
used for disk encryption.
The AES-XTS cipher decryption implementation for 64 bit ARM platform will read
past the end of the ciphertext buffer if the ciphertext size is 4 mod 5, e.g.
144 bytes or 1024 bytes. If the memory after the ciphertext buffer is
unmapped, this will trigger a crash which results in a denial of service.
If an attacker can control the size and location of the ciphertext buffer
being decrypted by an application using AES-XTS on 64 bit ARM, the
application is affected. This is fairly unlikely making this issue
a Low severity one.
OpenSSL versions 3.0.0 to 3.0.8, and 3.1.0 are vulnerable to this issue,
including the FIPS provider in those versions.
OpenSSL versions 1.1.1 and 1.0.2 are not affected by this issue.
Due to the low severity of this issue we are not issuing new releases of
OpenSSL at this time. The fix will be included in the next releases when they
become available. The fix is also available in commit bc2f61ad (for 3.1) and
commit 02ac9c94 (for 3.0) in the OpenSSL git repository.
This issue was reported on 27th February 2023 by Anton Romanov (Amazon).
The fix was developed by Nevine Ebeid (Amazon).
General Advisory Notes
URL for this Security Advisory:
Note: the online version of the advisory may be updated with additional details
For details of OpenSSL severity classifications please see:
OpenSSL 1.1.1 will reach end-of-life on 2023-09-11. After that date security
fixes for 1.1.1 will only be available to premium support customers.
-----BEGIN PGP SIGNATURE-----
-----END PGP SIGNATURE-----
More information about the openssl-users