CVE-2023-1255

Description

openssl: Input buffer over-read in AES-XTS implementation on 64 bit ARM

Red Hat statement

Applications that use the AES-XTS algorithm on the 64-bit ARM platform can crash in rare circumstances. The AES-XTS algorithm is usually for disk encryption. The AES-XTS cipher decryption implementation for 64 bit ARM platform will read past the end of the ciphertext buffer if the ciphertext size is 4 mod 5, for example, 144 bytes or 1024 bytes. If the memory after the ciphertext buffer is unmapped, this will trigger a crash, resulting in a denial of service. The application is affected if an attacker can control the size and location of the ciphertext buffer being decrypted by an application using AES-XTS on 64-bit ARM. This is fairly unlikely, making this issue a Low severity one.

CVSS v3: 5.1 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)

Errata / fixed releases

Package state