Severity
5.9MEDIUMNVD
EPSS
0.1%
top 75.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedApr 20
Latest updateSep 4

Description

Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM platform contains a bug that could cause it to read past the input buffer, leading to a crash. Impact summary: Applications that use the AES-XTS algorithm on the 64 bit ARM platform can crash in rare circumstances. The AES-XTS algorithm is usually used for disk encryption. The AES-XTS cipher decryption implementation for 64 bit ARM platform will read past the end of the ciphertext buffer if the ciphertext size is 4 mod

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 2.2 | Impact: 3.6

Affected Packages6 packages

debiandebian/openssl< openssl 3.0.9-1 (bookworm)
NVDopenssl/openssl3.0.03.0.9+1
Alpineopenssl/openssl< 3.0.8-r4+6
Debianopenssl/openssl< 3.0.9-1+2
Ubuntuopenssl/openssl< 1.1.1-1ubuntu2.1~18.04.23+2

Patches

🔴Vulnerability Details

4
OSV
openssl, openssl1.0 vulnerabilities2023-05-30
GHSA
GHSA-4wp2-xw7p-2gfx: Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM platform contains a bug that could cause it to read past the input buffer,2023-04-20
OSV
CVE-2023-1255: Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM platform contains a bug that could cause it to read past the input buffer,2023-04-20
OSV
CVE-2023-1255: Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM platform contains a bug that could cause it to read past the input buffer,2023-04-20

📋Vendor Advisories

6
Palo Alto
PAN-SA-2024-0008 Informational Bulletin: Impact of OSS CVEs in PAN-OS2024-09-04
CISA ICS
Siemens SINEC NMS2024-02-15
Ubuntu
OpenSSL vulnerabilities2023-05-30
Red Hat
openssl: Input buffer over-read in AES-XTS implementation on 64 bit ARM2023-04-20
Microsoft
Input buffer over-read in AES-XTS implementation on 64 bit ARM2023-04-11
CVE-2023-1255 — Out-of-bounds Read in Openssl | cvebase