Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM platform contains a bug that could cause it to read past the input buffer, leading to a crash.
Impact summary: Applications that use the AES-XTS algorithm on the 64 bit ARM platform can crash in rare circumstances. The AES-XTS algorithm is usually used for disk encryption.
The AES-XTS cipher decryption implementation for 64 bit ARM platform will read past the end of the ciphertext buffer if the ciphertext size is 4 mod 5 in 16 byte blocks, e.g. 144 bytes or 1024 bytes. If the memory after the ciphertext buffer is unmapped, this will trigger a crash which results in a denial of service.
If an attacker can control the size and location of the ciphertext buffer being decrypted by an application using AES-XTS on 64 bit ARM, the application is affected. This is fairly unlikely making this issue a Low severity one.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade opensslUpgrade openssl-develUpgrade openssl-libsUpgrade openssl-perl | Jun 27, 2023 | Apr 20, 2023 |
| Alpine Linux | — | Upgrade openssl3Upgrade openssl | Aug 22, 2024 | Apr 20, 2023 |
| Amazon_linux_2023 | — | Upgrade opensslUpgrade openssl-debugsourceUpgrade openssl-debuginfoUpgrade openssl-libs-debuginfoUpgrade openssl-develUpgrade openssl-libsUpgrade openssl-perl | Feb 17, 2025 | Apr 20, 2023 |
| Centos_linux | — | Upgrade openssl-perlUpgrade openssl-develUpgrade openssl-libsUpgrade openssl-debuginfoUpgrade opensslUpgrade openssl-libs-debuginfoUpgrade openssl-debugsource | Jun 22, 2023 | Apr 20, 2023 |
| Debian | — | Upgrade openssl | Jul 30, 2024 | Apr 20, 2023 |
| Http Openssl | — | Upgrade to the latest version of OpenSSL | Jun 5, 2024 | Apr 20, 2023 |
| Oracle_linux | — | Upgrade opensslUpgrade openssl-perlUpgrade openssl-develUpgrade openssl-libs | Jun 22, 2023 | Apr 20, 2023 |
| Rapid7 Insightagent | — | — | Mar 19, 2024 | Apr 20, 2023 |
| Redhat_linux | — | Upgrade openssl-libs-debuginfoUpgrade opensslUpgrade openssl-develUpgrade openssl-perlUpgrade openssl-debugsourceUpgrade openssl-libsUpgrade openssl-debuginfo | Jun 22, 2023 | Apr 20, 2023 |
| Rocky_linux | — | Upgrade openssl-debugsourceUpgrade openssl-libs-debuginfoUpgrade openssl-develUpgrade openssl-fips-provider-debuginfoUpgrade openssl-debuginfoUpgrade openssl-libsUpgrade openssl-fips-providerUpgrade opensslUpgrade openssl-fips-provider-debugsourceUpgrade openssl-perl | Jul 16, 2024 | Apr 20, 2023 |
| Suse | — | Upgrade libopenssl-3-develUpgrade libopenssl3Upgrade openssl-3Upgrade libopenssl-3-devel-32bitUpgrade libopenssl3-32bitUpgrade openssl-3-doc | Jun 9, 2023 | Apr 20, 2023 |
| Ubuntu | — | Upgrade libssl3 | May 31, 2023 | Apr 20, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 20, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub