PT-2022-5188 · Unknown+11 · Keccak Xkcp Sha-3+11
Nicky Mouha
·
Published
2022-10-20
·
Updated
2026-03-10
·
CVE-2022-37454
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Keccak XKCP SHA-3 reference implementation versions before fdc6fef
Description
The issue is related to an integer overflow and resultant buffer overflow in the sponge function interface of the Keccak XKCP SHA-3 reference implementation. This allows attackers to execute arbitrary code or eliminate expected cryptographic properties. The problem occurs when partial data with specific sizes are queued, where at least one of them has a length of 2^32 - 200 bytes or more.
Recommendations
To resolve the issue, update the Keccak XKCP SHA-3 reference implementation to a version after fdc6fef.
As a temporary workaround, consider limiting the size of the partial input data (or partial output digest) below 2^32 - 200 bytes.
Alternatively, process the entire input (or produce the entire output) at once, avoiding the queuing functions altogether.
Exploit
Fix
DoS
Integer Overflow
RCE
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Keccak Xkcp Sha-3
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu