PT-2023-4566 · Openssl+5 · Openssl+5

Anton Romanov + 1 · Published 2023-03-21 · Updated 2026-04-27 · CVE-2023-1255

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenSSL (affected versions not specified)

Description The AES-XTS cipher decryption implementation for 64-bit ARM platforms contains a bug that could cause it to read past the input buffer, leading to a crash. Applications that use the AES-XTS algorithm on the 64-bit ARM platform can crash in rare circumstances. The AES-XTS algorithm is usually used for disk encryption. If an attacker can control the size and location of the ciphertext buffer being decrypted by an application using AES-XTS on 64-bit ARM, the application is affected. This issue is considered to be of low severity.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALSA-2023:3722

BDU:2023-04972

CVE-2023-1255

JLSEC-2026-238

OPENSUSE-SU-2024:12969-1

RHSA-2023:3722

RHSA-2023_3722

SUSE-SU-2023:2470-1

SUSE-SU-2023:2620-1

SUSE-SU-2023_2620-1

USN-6119-1

Affected Products

Almalinux

Linuxmint

Openssl

Red Hat

Suse

Ubuntu

References · 59

• https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=02ac9c9420275868472f33b01def01218742b8bb · Patch
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/IGWYXCBOJHBE4KDZDQOUYC43RNMHRDBL · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04972 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/J6OR7PVNTELF5NATAMOMQWNTKHVAOW4O/https://ubuntu.com/security/notices/USN-6119-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-1255 · Security Note
• https://linux.oracle.com/errata/ELSA-2023-3722.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12969-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6119-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2023:3722 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-1255 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2023-1255 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-1255 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1255 · Security Note
• https://ubuntu.com/security/CVE-2023-1255 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2023-3722.html · Vendor Advisory