p PatchFirst

CVE-2023-1255

CVE-2023-1255 · Input buffer over-read in AES-XTS implementation on 64 bit ARM

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM platform contains a bug that could cause it to read past the input buffer, leading to a crash. Impact summary: Applications that use the AES-XTS algorithm on the 64 bit ARM platform can crash in rare circumstances. The AES-XTS algorithm is usually used for disk encryption. The AES-XTS cipher decryption implementation for 64 bit ARM platform will read past the end of the ciphertext buffer if the ciphertext size is 4 mod 5 in 16 byte blocks, e.g. 144 bytes or 1024 bytes. If the memory after the ciphertext buffer is unmapped, this will trigger a crash which results in a denial of service. If an attacker can control the size and location of the ciphertext buffer being decrypted by an application using AES-XTS on 64 bit ARM, the application is affected. This is fairly unlikely making this issue a Low severity one.

CVSS 5.9 · Medium · EPSS 1.0% · Fix available

Published
Updated

Stack: system · network

Affected products and versions

  • openssl

    Versions
    • ≥ 3.1.0, < 3.1.1: Affected (semver)
    • ≥ 3.0.0, < 3.0.9: Affected (semver)

    Update to 3.0.9; Update to 3.1.1

  • openssl Debian:12

    Affected ranges
    • ECOSYSTEM: < 3.0.9-1

    Update to 3.0.9-1

  • openssl Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.0.9-1

    Update to 3.0.9-1

  • openssl Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.0.9-1

    Update to 3.0.9-1

  • openssl Ubuntu:22.04:LTS

    Versions
    • 1.1.1l-1ubuntu1
    • 3.0.0-1ubuntu1
    • 3.0.1-0ubuntu1
    • 3.0.2-0ubuntu1
    • 3.0.2-0ubuntu1.1
    • 3.0.2-0ubuntu1.2
    • 3.0.2-0ubuntu1.4
    • 3.0.2-0ubuntu1.5
    • 3.0.2-0ubuntu1.6
    • 3.0.2-0ubuntu1.7
    • 3.0.2-0ubuntu1.8
    • 3.0.2-0ubuntu1.9
    Affected ranges
    • ECOSYSTEM: < 3.0.2-0ubuntu1.10

    Update to 3.0.2-0ubuntu1.10

  • nodejs Ubuntu:Pro:22.04:LTS

    Versions
    • 12.22.5~dfsg-5ubuntu1
    • 12.22.7~dfsg-2ubuntu1
    • 12.22.7~dfsg-2ubuntu3
    • 12.22.9~dfsg-1ubuntu2
    • 12.22.9~dfsg-1ubuntu3
    • 12.22.9~dfsg-1ubuntu3.1
    • 12.22.9~dfsg-1ubuntu3.2
    • 12.22.9~dfsg-1ubuntu3.3
    • 12.22.9~dfsg-1ubuntu3.4
    • 12.22.9~dfsg-1ubuntu3.5
    • 12.22.9~dfsg-1ubuntu3.6
    • 12.22.9~dfsg-1ubuntu3.6+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssl Ubuntu:Pro:FIPS-preview:22.04:LTS

    Affected ranges
    • ECOSYSTEM: < 3.0.2-0ubuntu1.10+Fips1

    Update to 3.0.2-0ubuntu1.10+Fips1

  • openssl Ubuntu:Pro:FIPS-updates:22.04:LTS

    Affected ranges
    • ECOSYSTEM: < 3.0.2-0ubuntu1.10+Fips1

    Update to 3.0.2-0ubuntu1.10+Fips1

Original sources

Check your server →