CVE-2023-4807

Summary

CVE-2023-4807: A vulnerability in the OpenSSL library's POLY1305 MAC implementation on Windows 64 platforms with AVX512-IFMA processors can lead to application state corruption. The issue arises due to the failure to save the contents of non-volatile XMM registers before resetting them upon MAC calculation of large data sets. This can result in incorrect application results or crashes, potentially leading to denial of service. The most common usage of the affected AEAD (authenticated encryption with associated data) algorithm is in TLS protocol versions 1.2 and 1.3, making server applications potentially vulnerable. However, no concrete applications have been identified as affected at this time, and the FIPS provider is not impacted. As a workaround, the AVX512-IFMA instructions support can be disabled at runtime by setting the OPENSSL_ia32cap environment variable.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.