Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM platform contains a bug that could cause it to read past the input buffer, leading to a crash.
Impact summary: Applications that use the AES-XTS algorithm on the 64 bit ARM platform can crash in rare circumstances. The AES-XTS algorithm is usually used for disk encryption.
The AES-XTS cipher decryption implementation for 64 bit ARM platform will read past the end of the ciphertext buffer if the ciphertext size is 4 mod 5 in 16 byte blocks, e.g. 144 bytes or 1024 bytes. If the memory after the ciphertext buffer is unmapped, this will trigger a crash which results in a denial of service.
If an attacker can control the size and location of the ciphertext buffer being decrypted by an application using AES-XTS on 64 bit ARM, the application is affected. This is fairly unlikely making this issue a Low severity one.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade openssl-develUpgrade opensslUpgrade openssl-libsUpgrade openssl-perl | Jun 27, 2023 | Apr 20, 2023 |
| Alpine Linux | — | Upgrade opensslUpgrade openssl3 | Aug 22, 2024 | Apr 20, 2023 |
| Amazon_linux_2023 | — | Upgrade openssl-debuginfoUpgrade opensslUpgrade openssl-debugsourceUpgrade openssl-libs-debuginfoUpgrade openssl-perlUpgrade openssl-develUpgrade openssl-libs | Feb 17, 2025 | Apr 20, 2023 |
| Centos_linux | — | Upgrade openssl-perlUpgrade openssl-libsUpgrade openssl-develUpgrade openssl-debuginfoUpgrade openssl-debugsourceUpgrade openssl-libs-debuginfoUpgrade openssl | Jun 22, 2023 | Apr 20, 2023 |
| Debian | — | Upgrade openssl | Jul 30, 2024 | Apr 20, 2023 |
| Http Openssl | — | Upgrade to the latest version of OpenSSL | Jun 5, 2024 | Apr 20, 2023 |
| Oracle_linux | — | Upgrade openssl-libsUpgrade openssl-perlUpgrade openssl-develUpgrade openssl | Jun 22, 2023 | Apr 20, 2023 |
| Rapid7 Insightagent | — | — | Mar 19, 2024 | Apr 20, 2023 |
| Redhat_linux | — | Upgrade opensslUpgrade openssl-perlUpgrade openssl-develUpgrade openssl-libs-debuginfoUpgrade openssl-libsUpgrade openssl-debugsourceUpgrade openssl-debuginfo | Jun 22, 2023 | Apr 20, 2023 |
| Rocky_linux | — | Upgrade openssl-debugsourceUpgrade openssl-debuginfoUpgrade openssl-develUpgrade openssl-fips-provider-debuginfoUpgrade openssl-libs-debuginfoUpgrade openssl-libsUpgrade openssl-perlUpgrade openssl-fips-provider-debugsourceUpgrade opensslUpgrade openssl-fips-provider | Jul 16, 2024 | Apr 20, 2023 |
| Suse | — | Upgrade libopenssl3-32bitUpgrade openssl-3-docUpgrade libopenssl-3-devel-32bitUpgrade openssl-3Upgrade libopenssl3Upgrade libopenssl-3-devel | Jun 9, 2023 | Apr 20, 2023 |
| Ubuntu | — | Upgrade libssl3 | May 31, 2023 | Apr 20, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 20, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub