diff options
| author | Tomas Mraz <tomas@openssl.org> | 2024-01-04 10:32:32 +0100 |
|---|---|---|
| committer | Tomas Mraz <tomas@openssl.org> | 2024-01-09 15:45:44 +0100 |
| commit | 858c7bc210a406cc7f891ac2aed78692d2e02937 (patch) | |
| tree | 1874b023e6afc86428fbb98a1a34e29a8f6457fb /CHANGES.md | |
| parent | 8d847a3ffd4f0b17ee33962cf69c36224925b34f (diff) | |
Add CHANGES.md and NEWS.md entries for CVE-2023-6129
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23200)
Diffstat (limited to 'CHANGES.md')
| -rw-r--r-- | CHANGES.md | 21 |
1 files changed, 21 insertions, 0 deletions
diff --git a/CHANGES.md b/CHANGES.md index 031c7101f8..43b02502d8 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -75,6 +75,26 @@ OpenSSL 3.2 ### Changes between 3.2.0 and 3.2.1 [xx XXX xxxx] + * The POLY1305 MAC (message authentication code) implementation in OpenSSL + for PowerPC CPUs saves the contents of vector registers in different + order than they are restored. Thus the contents of some of these vector + registers is corrupted when returning to the caller. The vulnerable code is + used only on newer PowerPC processors supporting the PowerISA 2.07 + instructions. + + The consequences of this kind of internal application state corruption can + be various - from no consequences, if the calling application does not + depend on the contents of non-volatile XMM registers at all, to the worst + consequences, where the attacker could get complete control of the + application process. However unless the compiler uses the vector registers + for storing pointers, the most likely consequence, if any, would be an + incorrect result of some application dependent calculations or a crash + leading to a denial of service. + + ([CVE-2023-6129]) + + *Rohan McLure* + * Disable building QUIC server utility when OpenSSL is configured with `no-apps`. @@ -20380,6 +20400,7 @@ ndif <!-- Links --> +[CVE-2023-6129]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-6129 [CVE-2023-5678]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-5678 [CVE-2023-5363]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-5363 [CVE-2023-4807]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-4807 |