OpenSSL up to 3.0.11/3.1.4/3.2.0 on PowerPC POLY1305 MAC improper authentication

Summaryinfo

A vulnerability classified as critical has been found in OpenSSL up to 3.0.11/3.1.4/3.2.0 on PowerPC. This affects an unknown function of the component POLY1305 MAC Handler. Performing a manipulation results in improper authentication. This vulnerability is reported as CVE-2023-6129. The attack is possible to be carried out remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in OpenSSL up to 3.0.11/3.1.4/3.2.0 on PowerPC (Network Encryption Software). This affects some unknown processing of the component POLY1305 MAC Handler. The manipulation with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instructions. Impact summary: If an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences. The POLY1305 MAC (message authentication code) implementation in OpenSSL for PowerPC CPUs restores the contents of vector registers in a different order than they are saved. Thus the contents of some of these vector registers are corrupted when returning to the caller. The vulnerable code is used only on newer PowerPC processors supporting the PowerISA 2.07 instructions. The consequences of this kind of internal application state corruption can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However unless the compiler uses the vector registers for storing pointers, the most likely consequence, if any, would be an incorrect result of some application dependent calculations or a crash leading to a denial of service. The POLY1305 MAC algorithm is most frequently used as part of the CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of this AEAD cipher is with TLS protocol versions 1.2 and 1.3. If this cipher is enabled on the server a malicious client can influence whether this AEAD cipher is used. This implies that TLS server applications using OpenSSL can be potentially impacted. However we are currently not aware of any concrete application that would be affected by this issue therefore we consider this a Low severity security issue.

The weakness was disclosed 01/09/2024 by Sverker Eriksson as 20240109.txt. The advisory is shared at openssl.org. This vulnerability is uniquely identified as CVE-2023-6129 since 11/14/2023. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/06/2025).

The vulnerability scanner Nessus provides a plugin with the ID 210835 (RHEL 9 : edk2 (RHSA-2024:9088)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.0.12, 3.1.5 or 3.2.1 eliminates this vulnerability. Applying the patch 5b139f95c9a47a55a0c54100f3837b1eee942b04 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (210835) and CERT Bund (WID-SEC-2024-0894). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Oracle MySQL
• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Fedora Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• Xerox FreeFlow Print Server
• RESF Rocky Linux
• MariaDB MariaDB

Productinfo

Type

• Network Encryption Software

Name

• OpenSSL

Version

• 3.0
• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 3.0.6
• 3.0.7
• 3.0.8
• 3.0.9
• 3.0.10
• 3.0.11
• 3.1
• 3.1.0
• 3.1.1
• 3.1.2
• 3.1.3
• 3.1.4
• 3.2.0

License

• open-source

Website

• Product: https://www.openssl.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion