Vulnerability in OpenSSL AES OCB Mode on 32-bit x86 Platforms
Summary
CVE-2022-2097: AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. Affects openssl across 2 version ranges.
< 1.1.1q-r0
>= 89cd17a031e022211684eb7eb41190cf1910f9fa, < ad4910fad22d57c6d685b0ca83bdb7b2bf69d8fd
Fixed in 1.1.1q-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSL is an open-source cryptographic library that provides various cryptographic functions, including encryption, decryption, and secure communication protocols. It is widely used in many applications and systems to ensure data security. However, a vulnerability has been discovered in the AES OCB mode implementation for 32-bit x86 platforms using the AES-NI assembly optimization in OpenSSL.
Vulnerability Detail
The vulnerability (CVE-2022-2097) in OpenSSL AES OCB mode on 32-bit x86 platforms allows for the potential exposure of sixteen bytes of preexisting memory data that was not written. In certain circumstances, this can result in the revelation of plaintext data during 'in place' encryption. It is important to note that this vulnerability does not affect OpenSSL's support for OCB-based cipher suites for TLS and DTLS. The vulnerability has been fixed in OpenSSL versions 3.0.5 and 1.1.1q.
How To Fix
Minimum fixed version
1.1.1q-r0
This is the first release that contains the fix.
sudo apk add --upgrade opensslTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to update OpenSSL to the fixed versions as mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability in OpenSSL AES OCB mode on 32-bit x86 platforms can potentially expose preexisting memory data during 'in place' encryption. It is crucial to update OpenSSL to the fixed versions to mitigate the risk of data exposure. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for openssl →
FAQ
OpenSSL is an open-source cryptographic library used for encryption, decryption, and secure communication protocols.
The vulnerability could potentially expose sixteen bytes of preexisting memory data during 'in place' encryption.
OpenSSL versions 3.0.0 to 3.0.4 and 1.1.1 to 1.1.1p are affected by this vulnerability.
No, this vulnerability does not affect OpenSSL's support for OCB-based cipher suites for TLS and DTLS.
To fix this vulnerability, update OpenSSL to the fixed versions: 3.0.5 or 1.1.1q.
References
Related vulnerabilities
Recent vulnerabilities recorded for openssl.
