Vulnerability · Published Apr 20, 2023 · Assigned by openssl
CVE-2023-1255Input buffer over-read in AES-XTS implementation on 64 bit ARM
Medium 5.9
In plain English
A medium-severity out-of-bounds read in OpenSSL from OpenSSL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM platform contains a bug that could cause it to read past the input buffer, leading to a crash. Impact summary: Applications that use the AES-XTS algorithm on the 64 bit ARM platform can crash in rare circumstances. The AES-XTS algorithm is usually used for disk encryption. The AES-XTS cipher decryption implementation for 64 bit ARM platform will read past the end of the ciphertext buffer if the ciphertext size is 4 mod 5 in 16 byte blocks, e.g. 144 bytes or 1024 bytes. If the memory after the ciphertext buffer is unmapped, this will trigger a crash which results in a denial of service. If an attacker can control the size and location of the ciphertext buffer being decrypted by an application using AES-XTS on 64 bit ARM, the application is affected. This is fairly unlikely making this issue a Low severity one.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | openssl | 1:3.0.7-16.el9_2 | ALSA-2023:3722 |
| AlmaLinux:9 | openssl-devel | 1:3.0.7-16.el9_2 | ALSA-2023:3722 |
| AlmaLinux:9 | openssl-libs | 1:3.0.7-16.el9_2 | ALSA-2023:3722 |
| AlmaLinux:9 | openssl-perl | 1:3.0.7-16.el9_2 | ALSA-2023:3722 |
| Alpine:v3.20 | openssl | 3.1.0-r4 | ALPINE-CVE-2023-1255 |
| Alpine:v3.21 | openssl | 3.1.0-r4 | ALPINE-CVE-2023-1255 |
| Alpine:v3.22 | openssl | 3.1.0-r4 | ALPINE-CVE-2023-1255 |
| Alpine:v3.23 | openssl | 3.1.0-r4 | ALPINE-CVE-2023-1255 |
| Alpine:v3.24 | openssl | 3.1.0-r4 | ALPINE-CVE-2023-1255 |
| Debian:12 | openssl | 3.0.9-1 | DEBIAN-CVE-2023-1255 |
| Debian:13 | openssl | 3.0.9-1 | DEBIAN-CVE-2023-1255 |
| Debian:14 | openssl | 3.0.9-1 | DEBIAN-CVE-2023-1255 |
| Ubuntu:22.04:LTS | openssl | 3.0.2-0ubuntu1.10 | USN-6119-1 |
| Ubuntu:22.04:LTS | openssl | 3.0.2-0ubuntu1.10 | UBUNTU-CVE-2023-1255 |
Affected products (as reported)
Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- OpenSSL Advisory vendor-advisory
- 3.1.1 git commit patch
- 3.0.9 git commit patch
- https://security.netapp.com/advisory/ntap-20230908-0006/