CVE-2023-6129 in OpenSSL
Summary
by MITRE • 01/09/2024
Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instructions.
Impact summary: If an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences.
The POLY1305 MAC (message authentication code) implementation in OpenSSL for PowerPC CPUs restores the contents of vector registers in a different order than they are saved. Thus the contents of some of these vector registers are corrupted when returning to the caller. The vulnerable code is used only on newer PowerPC processors supporting the PowerISA 2.07 instructions.
The consequences of this kind of internal application state corruption can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However unless the compiler uses the vector registers for storing pointers, the most likely consequence, if any, would be an incorrect result of some application dependent calculations or a crash leading to a denial of service.
The POLY1305 MAC algorithm is most frequently used as part of the CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of this AEAD cipher is with TLS protocol versions 1.2 and 1.3. If this cipher is enabled on the server a malicious client can influence whether this AEAD cipher is used. This implies that TLS server applications using OpenSSL can be potentially impacted. However we are currently not aware of any concrete application that would be affected by this issue therefore we consider this a Low severity security issue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/06/2025
The vulnerability described in CVE-2023-6129 represents a critical state corruption issue within OpenSSL's POLY1305 message authentication code implementation on PowerPC architectures. This flaw specifically affects systems utilizing PowerISA 2.07 compliant processors that support vector instructions, creating a scenario where the internal state of applications can become corrupted during cryptographic operations. The issue stems from an improper handling of vector register restoration during function calls, where the saved vector register contents are restored in a different order than they were originally saved. This misalignment creates a condition where certain vector registers contain corrupted data when control returns to the calling application, fundamentally compromising the integrity of the application's runtime environment. The vulnerability operates at the intersection of low-level hardware instruction handling and high-level cryptographic security implementations, making it particularly insidious as it can manifest in unpredictable ways depending on how the affected application utilizes these registers.
The technical execution of this vulnerability requires an attacker to influence the cryptographic algorithm selection process within OpenSSL's TLS implementation, specifically targeting the CHACHA20-POLY1305 AEAD cipher suite. Since this cipher is commonly used in TLS 1.2 and 1.3 protocols, a malicious client can potentially force a server application to utilize the vulnerable POLY1305 implementation. The attack vector is particularly relevant in server-side applications where OpenSSL handles TLS connections, as the attacker only needs to establish a connection using a cipher suite that includes the vulnerable algorithm. This creates a scenario where the attacker can control whether the corrupted vector register state is triggered, making the vulnerability exploitable in a targeted manner. The underlying cause of this issue aligns with CWE-122, which addresses improper handling of memory regions and register states, while the specific implementation flaw relates to CWE-787, concerning out-of-bounds writes in vector register operations.
The operational impact of this vulnerability varies significantly based on application dependencies and compiler optimizations. Applications that do not rely on vector register contents for pointer storage or critical execution paths may experience minimal consequences, potentially resulting in incorrect calculation results or service disruption through denial of service. However, in scenarios where the corrupted register contents influence program flow or data integrity, the consequences could escalate to complete application compromise, potentially allowing attackers to gain control over the executing process. The vulnerability's severity classification as low reflects the limited number of affected applications and the specific hardware requirements, but the potential for state corruption remains a serious concern. The attack surface is primarily limited to TLS server implementations using OpenSSL, with the most likely impact being service availability rather than direct privilege escalation, though the underlying register corruption could theoretically enable more sophisticated attacks depending on application architecture and memory management patterns.
Mitigation strategies for this vulnerability focus on both immediate remediation and long-term architectural considerations. The primary solution involves updating to patched versions of OpenSSL that correct the vector register restoration order, ensuring that saved register contents are restored in the exact reverse order of their saving. Organizations should prioritize patching TLS server applications that utilize the affected cipher suites, particularly those exposed to untrusted clients. System administrators should also consider implementing monitoring for unusual application behavior or crashes that might indicate register corruption, as these could serve as early warning indicators. From an operational security perspective, the vulnerability highlights the importance of thorough testing on target hardware platforms, particularly when implementing cryptographic libraries that interact with specific instruction sets. The issue demonstrates the necessity of considering hardware-specific implementation details in security-critical software, as the interaction between software cryptography and processor architecture can create unexpected vulnerabilities. Additionally, organizations should review their TLS configuration policies to minimize exposure to affected cipher suites where possible, while maintaining awareness of similar hardware-specific issues that could affect other cryptographic implementations.