PT-2023-20477 · Arm · Arm Aarch64Cryptolib

Milinjpatel + 1 · Publicado 2023-03-15 · Atualizado 2025-02-27 · CVE-2023-26084

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Baixa

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Arm AArch64cryptolib versions before 86065c6

Description The issue concerns the armv8 dec aes gcm full() API, which fails to verify the authentication tag of AES-GCM protected data. This failure is due to an improperly initialized variable, leading to a potential man-in-the-middle attack.

Recommendations For Arm AArch64cryptolib versions before 86065c6, update to a version after 86065c6 to resolve the issue. As a temporary workaround, consider restricting the use of the armv8 dec aes gcm full() API until a patch is available.

Correção

Improper Initialization

Enumeração de Fraquezas

CWE-665

Identificadores relacionados

CVE-2023-26084

GHSA-47C6-7X5X-R74G

Produtos afetados

Arm Aarch64Cryptolib

Referências · 5

• https://github.com/ARM-software/AArch64cryptolib/security/advisories/GHSA-47c6-7x5x-r74g · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-26084 · Nota de Segurança
• https://t.me/cvenotify/112715 · Publicação no Telegram
• https://t.me/cibsecurity/60061 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-26084 · Aviso do Fabricante