CVE-2023-4807
CVSS 3.1 Score 7.8 of 10 (high)
Details
Summary
CVE-2023-4807: A vulnerability in the OpenSSL library's POLY1305 MAC implementation on Windows 64 platforms with AVX512-IFMA processors can lead to application state corruption. The issue arises due to the failure to save the contents of non-volatile XMM registers before resetting them upon MAC calculation of large data sets. This can result in incorrect application results or crashes, potentially leading to denial of service. The most common usage of the affected AEAD (authenticated encryption with associated data) algorithm is in TLS protocol versions 1.2 and 1.3, making server applications potentially vulnerable. However, no concrete applications have been identified as affected at this time, and the FIPS provider is not impacted. As a workaround, the AVX512-IFMA instructions support can be disabled at runtime by setting the OPENSSL_ia32cap environment variable.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- OpenSSL
- Openssl Project Openssl
Affected Vendors
- The OpenSSL Project
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions