CVE-2023-42811 AEADs/aes-gcm: Plaintext exposed in decrypt_in_place_detached even on tag verification failure

2023-09-2215:19:15

CWE-347

GitHub_M

www.cve.org

cve-2023-42811

plaintext exposure

aes-gcm

rust implementation

buffer access

chosen ciphertext attacks

CVSS3

4.7

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N

EPSS

0.001

Percentile

16.8%

JSON

aes-gcm is a pure Rust implementation of the AES-GCM. Starting in version 0.10.0 and prior to version 0.10.3, in the AES GCM implementation of decrypt_in_place_detached, the decrypted ciphertext (i.e. the correct plaintext) is exposed even if tag verification fails. If a program using the aes-gcm crate’s decrypt_in_place* APIs accesses the buffer after decryption failure, it will contain a decryption of an unauthenticated input. Depending on the specific nature of the program this may enable Chosen Ciphertext Attacks (CCAs) which can cause a catastrophic breakage of the cipher including full plaintext recovery. Version 0.10.3 contains a fix for this issue.

CNA Affected

[
  {
    "vendor": "RustCrypto",
    "product": "AEADs",
    "versions": [
      {
        "version": ">= 0.10.0, < 0.10.3",
        "status": "affected"
      }
    ]
  }
]