diff options
| author | Tomas Mraz <tomas@openssl.org> | 2024-01-04 10:32:32 +0100 |
|---|---|---|
| committer | Tomas Mraz <tomas@openssl.org> | 2024-01-09 15:46:24 +0100 |
| commit | 5def27cc65224447d6f2c7c164201634406a4dc8 (patch) | |
| tree | a54707569eeb2f330f557620c09948780b10a380 /CHANGES.md | |
| parent | 5b139f95c9a47a55a0c54100f3837b1eee942b04 (diff) | |
Add CHANGES.md and NEWS.md entries for CVE-2023-6129
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23200)
(cherry picked from commit 858c7bc210a406cc7f891ac2aed78692d2e02937)
Diffstat (limited to 'CHANGES.md')
| -rw-r--r-- | CHANGES.md | 21 |
1 files changed, 21 insertions, 0 deletions
diff --git a/CHANGES.md b/CHANGES.md index fa8b0b65ed..e1ac7adc08 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -27,6 +27,26 @@ OpenSSL 3.2 ### Changes between 3.2.0 and 3.2.1 [xx XXX xxxx] + * The POLY1305 MAC (message authentication code) implementation in OpenSSL + for PowerPC CPUs saves the contents of vector registers in different + order than they are restored. Thus the contents of some of these vector + registers is corrupted when returning to the caller. The vulnerable code is + used only on newer PowerPC processors supporting the PowerISA 2.07 + instructions. + + The consequences of this kind of internal application state corruption can + be various - from no consequences, if the calling application does not + depend on the contents of non-volatile XMM registers at all, to the worst + consequences, where the attacker could get complete control of the + application process. However unless the compiler uses the vector registers + for storing pointers, the most likely consequence, if any, would be an + incorrect result of some application dependent calculations or a crash + leading to a denial of service. + + ([CVE-2023-6129]) + + *Rohan McLure* + * Disable building QUIC server utility when OpenSSL is configured with `no-apps`. @@ -20326,6 +20346,7 @@ ndif <!-- Links --> +[CVE-2023-6129]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-6129 [CVE-2023-5678]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-5678 [CVE-2023-5363]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-5363 [CVE-2023-4807]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-4807 |