Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2023-4807: OpenSSL on Windows may corrupt app memory during POLY1305
CVE-2023-4807 · published 3 years ago
Summary
The OpenSSL library on 64‑bit Windows can overwrite important internal data when it calculates a POLY1305 authentication code on newer processors. This may cause wrong results, crashes, or a denial of service for programs that use OpenSSL. Update OpenSSL to the latest version or apply the vendor's patch to fix the problem.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Alpine:v3.15 | alpine | openssl3 | All versions |
| Alpine:v3.15 | alpine | openssl | >= 1.1.1 |
| Alpine:v3.16 | alpine | openssl3 | All versions |
| Alpine:v3.16 | alpine | openssl | >= 1.1.1 |
| Alpine:v3.17 | alpine | openssl | >= 1.1.1 |
| Alpine:v3.18 | alpine | openssl | >= 1.1.1 |
| Alpine:v3.19 | alpine | openssl | >= 1.1.1 |
| Alpine:v3.20 | alpine | openssl | >= 1.1.1 |
| Alpine:v3.21 | alpine | openssl | >= 1.1.1 |
| Alpine:v3.22 | alpine | openssl | >= 1.1.1 |
| Alpine:v3.23 | alpine | openssl | >= 1.1.1 |
| Alpine:v3.24 | alpine | openssl | >= 1.1.1 |
| – | openssl | openssl |
>= 1.1.1, < 1.1.1w >= 3.0.0, < 3.0.11 >= 3.1.0, < 3.1.3 < 3.1.3 cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* |
Original advisory text
POLY1305 MAC implementation corrupts XMM registers on Windows
Issue summary: The POLY1305 MAC (message authentication code) implementation
contains a bug that might corrupt the internal state of applications on the
Windows 64 platform when running on newer X86_64 processors supporting the
AVX512-IFMA instructions.
Impact summary: If in an application that uses the OpenSSL library an attacker
can influence whether the POLY1305 MAC algorithm is used, the application
state might be corrupted with various application dependent consequences.
The POLY1305 MAC (message authentication code) implementation in OpenSSL does
not save the contents of non-volatile XMM registers on Windows 64 platform
when calculating the MAC of data larger than 64 bytes. Before returning to
the caller all the XMM registers are set to zero rather than restoring their
previous content. The vulnerable code is used only on newer x86_64 processors
supporting the AVX512-IFMA instructions.
The consequences of this kind of internal application state corruption can
be various - from no consequences, if the calling application does not
depend on the contents of non-volatile XMM registers at all, to the worst
consequences, where the attacker could get complete control of the application
process. However given the contents of the registers are just zeroized so
the attacker cannot put arbitrary values inside, the most likely consequence,
if any, would be an incorrect result of some application dependent
calculations or a crash leading to a denial of service.
The POLY1305 MAC algorithm is most frequently used as part of the
CHACHA20-POLY1305 AEAD (authenticated encryption with associated data)
algorithm. The most common usage of this AEAD cipher is with TLS protocol
versions 1.2 and 1.3 and a malicious client can influence whether this AEAD
cipher is used by the server. This implies that server applications using
OpenSSL can be potentially impacted. However we are currently not aware of
any concrete application that would be affected by this issue therefore we
consider this a Low severity security issue.
As a workaround the AVX512-IFMA instructions support can be disabled at
runtime by setting the environment variable OPENSSL_ia32cap:
OPENSSL_ia32cap=:~0x200000
The FIPS provider is not affected by this issue.
contains a bug that might corrupt the internal state of applications on the
Windows 64 platform when running on newer X86_64 processors supporting the
AVX512-IFMA instructions.
Impact summary: If in an application that uses the OpenSSL library an attacker
can influence whether the POLY1305 MAC algorithm is used, the application
state might be corrupted with various application dependent consequences.
The POLY1305 MAC (message authentication code) implementation in OpenSSL does
not save the contents of non-volatile XMM registers on Windows 64 platform
when calculating the MAC of data larger than 64 bytes. Before returning to
the caller all the XMM registers are set to zero rather than restoring their
previous content. The vulnerable code is used only on newer x86_64 processors
supporting the AVX512-IFMA instructions.
The consequences of this kind of internal application state corruption can
be various - from no consequences, if the calling application does not
depend on the contents of non-volatile XMM registers at all, to the worst
consequences, where the attacker could get complete control of the application
process. However given the contents of the registers are just zeroized so
the attacker cannot put arbitrary values inside, the most likely consequence,
if any, would be an incorrect result of some application dependent
calculations or a crash leading to a denial of service.
The POLY1305 MAC algorithm is most frequently used as part of the
CHACHA20-POLY1305 AEAD (authenticated encryption with associated data)
algorithm. The most common usage of this AEAD cipher is with TLS protocol
versions 1.2 and 1.3 and a malicious client can influence whether this AEAD
cipher is used by the server. This implies that server applications using
OpenSSL can be potentially impacted. However we are currently not aware of
any concrete application that would be affected by this issue therefore we
consider this a Low severity security issue.
As a workaround the AVX512-IFMA instructions support can be disabled at
runtime by setting the environment variable OPENSSL_ia32cap:
OPENSSL_ia32cap=:~0x200000
The FIPS provider is not affected by this issue.
References
- https://security.alpinelinux.org/vuln/CVE-2023-4807 Vendor Advisory
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=4bfac4471f53c4f74c8... patch
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6754de4a121ec7f261b... patch
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=a632d534c73eeb3e3db... patch
- https://security.netapp.com/advisory/ntap-20230921-0001/
- https://www.openssl.org/news/secadv/20230908.txt vendor-advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-440Expected Behavior Violation
Timeline
Published8 Sep 2023
Updated3 Nov 2026
First seen12 Apr 2026
Track software like this
Free during beta