CVE-2023-6129

Summary

CVE-2023-6129 is a vulnerability in the POLY1305 MAC implementation in OpenSSL for PowerPC CPUs. The issue arises due to a bug that restores vector register contents in an incorrect order upon return to the caller, potentially corrupting the application state. This corruption could result in incorrect calculations, crashes, or even complete control of the application process. The vulnerability is most relevant to CHACHA20-POLY1305 AEAD algorithm used in TLS protocol versions 1.2 and 1.3. Servers using OpenSSL and this specific cipher are at risk if a malicious client can influence its use. However, no known applications have been identified as being affected. Thus, the severity of this issue is considered low.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.