Improper Verification of Cryptographic Signature in AEADs aes-gcm - CVE-2023-42811
Published: October 3, 2023
Vulnerability identifier: #VU81449
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2023-42811
CWE-ID: CWE-347
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Rust Crypto
Affected software:
AEADs aes-gcm
AEADs aes-gcm
Detailed vulnerability description
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to an error in AES GCM implementation of decrypt_in_place_detached. The decrypted ciphertext (i.e. the correct plaintext) is exposed even if tag verification fails. A local user can gain access to sensitive information.
How to mitigate CVE-2023-42811
Install updates from vendor's website.
Sources
- https://docs.rs/aes-gcm/latest/src/aes_gcm/lib.rs.html#309
- https://github.com/RustCrypto/AEADs/security/advisories/GHSA-423w-p2w9-r7vq
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RYQCICN6BVC6I75O3F6W4VK4J3MOYDJU/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U67ZSMNX5V3WTBYPUYF45PSFG4SF5SGF/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ROBB6TBDAGEQ2WIINR34F3DPSN3FND6K/