CVE-2023-1255

/// Technical description

Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM

platform contains a bug that could cause it to read past the input buffer,

leading to a crash.

Impact summary: Applications that use the AES-XTS algorithm on the 64 bit ARM

platform can crash in rare circumstances. The AES-XTS algorithm is usually

used for disk encryption.

The AES-XTS cipher decryption implementation for 64 bit ARM platform will read

past the end of the ciphertext buffer if the ciphertext size is 4 mod 5 in 16

byte blocks, e.g. 144 bytes or 1024 bytes. If the memory after the ciphertext

buffer is unmapped, this will trigger a crash which results in a denial of

service.

If an attacker can control the size and location of the ciphertext buffer

being decrypted by an application using AES-XTS on 64 bit ARM, the

application is affected. This is fairly unlikely making this issue

a Low severity one.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References