CVE-2023-4807

一、漏洞信息
 漏洞编号：[CVE-2023-4807](https://nvd.nist.gov/vuln/detail/CVE-2023-4807)
 漏洞归属组件：[compat-openssl11](https://gitee.com/src-openeuler/compat-openssl11)
 漏洞归属的版本：1.1.1m
 CVSS V3.0分值：
  BaseScore：7.8 High
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 漏洞简述：
  Issue summary: The POLY1305 MAC (message authentication code) implementationcontains a bug that might corrupt the internal state of applications on theWindows 64 platform when running on newer X86_64 processors supporting theAVX512-IFMA instructions.Impact summary: If in an application that uses the OpenSSL library an attackercan influence whether the POLY1305 MAC algorithm is used, the applicationstate might be corrupted with various application dependent consequences.The POLY1305 MAC (message authentication code) implementation in OpenSSL doesnot save the contents of non-volatile XMM registers on Windows 64 platformwhen calculating the MAC of data larger than 64 bytes. Before returning tothe caller all the XMM registers are set to zero rather than restoring theirprevious content. The vulnerable code is used only on newer x86_64 processorssupporting the AVX512-IFMA instructions.The consequences of this kind of internal application state corruption canbe various - from no consequences, if the calling application does notdepend on the contents of non-volatile XMM registers at all, to the worstconsequences, where the attacker could get complete control of the applicationprocess. However given the contents of the registers are just zeroized sothe attacker cannot put arbitrary values inside, the most likely consequence,if any, would be an incorrect result of some application dependentcalculations or a crash leading to a denial of service.The POLY1305 MAC algorithm is most frequently used as part of theCHACHA20-POLY1305 AEAD (authenticated encryption with associated data)algorithm. The most common usage of this AEAD cipher is with TLS protocolversions 1.2 and 1.3 and a malicious client can influence whether this AEADcipher is used by the server. This implies that server applications usingOpenSSL can be potentially impacted. However we are currently not aware ofany concrete application that would be affected by this issue therefore weconsider this a Low severity security issue.As a workaround the AVX512-IFMA instructions support can be disabled atruntime by setting the environment variable OPENSSL_ia32cap:   OPENSSL_ia32cap=:~0x200000The FIPS provider is not affected by this issue.
 漏洞公开时间：2023-09-08 20:15:08
 漏洞创建时间：2025-04-24 02:15:25
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2023-4807
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| openssl-security.openssl.org | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=4bfac4471f53c4f74c8d81020beb938f92d84ca5 |  |
| openssl-security.openssl.org | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6754de4a121ec7f261b16723180df6592cbb4508 |  |
| openssl-security.openssl.org | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=a632d534c73eeb3e3db8c7540d811194ef7c79ff |  |
| openssl-security.openssl.org | https://www.openssl.org/news/secadv/20230908.txt |  |
| af854a3a-2127-422b-91ae-364da2661108 | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=4bfac4471f53c4f74c8d81020beb938f92d84ca5 |  |
| af854a3a-2127-422b-91ae-364da2661108 | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6754de4a121ec7f261b16723180df6592cbb4508 |  |
| af854a3a-2127-422b-91ae-364da2661108 | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=a632d534c73eeb3e3db8c7540d811194ef7c79ff |  |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.netapp.com/advisory/ntap-20230921-0001/ |  |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.openssl.org/news/secadv/20230908.txt |  |
| suse_bugzilla | https://www.openssl.org/news/secadv/20230908.txt | https://bugzilla.suse.com/show_bug.cgi?id=1215170 |
| redhat_bugzilla | https://www.openssl.org/news/secadv/20230908.txt | https://bugzilla.redhat.com/show_bug.cgi?id=2238009 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2023-4807 |
| oracle |  | https://www.oracle.com/security-alerts/cpuapr2024.html |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2023-4807 |
| cve_search |  | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=a632d534c73eeb3e3db8c7540d811194ef7c79ff |
| cve_search |  | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=4bfac4471f53c4f74c8d81020beb938f92d84ca5 |
| cve_search |  | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6754de4a121ec7f261b16723180df6592cbb4508 |
| cve_search |  | https://www.openssl.org/news/secadv/20230908.txt |
| python-cryptography |  | https://github.com//pyca/cryptography/security/advisories/GHSA-v8gr-m533-ghj9 |
| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2023-4807 | https://explore.alas.aws.amazon.com/CVE-2023-4807.html |
| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4807 | https://explore.alas.aws.amazon.com/CVE-2023-4807.html |
| snyk | https://github.com/openssl/openssl/commit/4bfac4471f53c4f74c8d81020beb938f92d84ca5 | https://security.snyk.io/vuln/SNYK-UNMANAGED-OPENSSL-5891065 |
| snyk | https://github.com/openssl/openssl/commit/6754de4a121ec7f261b16723180df6592cbb4508 | https://security.snyk.io/vuln/SNYK-UNMANAGED-OPENSSL-5891065 |
| snyk | https://github.com/openssl/openssl/commit/a632d534c73eeb3e3db8c7540d811194ef7c79ff | https://security.snyk.io/vuln/SNYK-UNMANAGED-OPENSSL-5891065 |
| snyk | https://bugzilla.redhat.com/show_bug.cgi?id=2238009 | https://security.snyk.io/vuln/SNYK-UNMANAGED-OPENSSL-5891065 |
| snyk | https://www.openssl.org/news/secadv/20230908.txt | https://security.snyk.io/vuln/SNYK-UNMANAGED-OPENSSL-5891065 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=4bfac4471f53c4f74c8d81020beb938f92d84ca5 |  | openssl-security.openssl.org |
|  |  | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6754de4a121ec7f261b16723180df6592cbb4508 |  | openssl-security.openssl.org |
|  |  | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=a632d534c73eeb3e3db8c7540d811194ef7c79ff |  | openssl-security.openssl.org |
|  |  | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=4bfac4471f53c4f74c8d81020beb938f92d84ca5 |  | af854a3a-2127-422b-91ae-364da2661108 |
|  |  | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6754de4a121ec7f261b16723180df6592cbb4508 |  | af854a3a-2127-422b-91ae-364da2661108 |
|  |  | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=a632d534c73eeb3e3db8c7540d811194ef7c79ff |  | af854a3a-2127-422b-91ae-364da2661108 |
|  |  | https://github.com/openssl/openssl/commit/4bfac4471f53c4f74c8d81020beb938f92d84ca5 |  | snyk |
|  |  | https://github.com/openssl/openssl/commit/6754de4a121ec7f261b16723180df6592cbb4508 |  | snyk |
|  |  | https://github.com/openssl/openssl/commit/a632d534c73eeb3e3db8c7540d811194ef7c79ff |  | snyk |
|  |  | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=4bfac4471f53c4f74c8d81020beb938f92d84ca5 |  | nvd |
|  |  | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6754de4a121ec7f261b16723180df6592cbb4508 |  | nvd |
|  |  | https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=a632d534c73eeb3e3db8c7540d811194ef7c79ff |  | nvd |
|  |  | https://www.openssl.org/news/secadv/20230908.txt |  | nvd |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  openssl Poly1305 Mac 汇编实现在window X86-64平台编译存在问题，该问题会导致xmm寄存器状态在使用后未恢复使用前的状态，导致系统上其它使用了xmm寄存器的程序发生错误，从而导致程序崩溃。该bug只会影响window X86-64平台。openeuler不受影响。
 openEuler评分：
  7.8
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.master(1.1.1m):不受影响
2.openEuler-20.03-LTS-SP4:不受影响
3.openEuler-22.03-LTS-SP3:不受影响
4.openEuler-22.03-LTS-SP4:不受影响
5.openEuler-24.03-LTS(1.1.1m):不受影响
6.openEuler-24.03-LTS-Next(1.1.1m):不受影响
7.openEuler-24.03-LTS-SP1(1.1.1m):不受影响
8.openEuler-24.03-LTS-SP2(1.1.1m):不受影响

修复是否涉及abi变化(是/否)：
  1.master(1.1.1m):否
2.openEuler-20.03-LTS-SP4:否
3.openEuler-22.03-LTS-SP3:否
4.openEuler-22.03-LTS-SP4:否
5.openEuler-24.03-LTS(1.1.1m):否
6.openEuler-24.03-LTS-Next(1.1.1m):否
7.openEuler-24.03-LTS-SP1(1.1.1m):否
8.openEuler-24.03-LTS-SP2(1.1.1m):否

原因说明：
  1.openEuler-20.03-LTS-SP4:不受影响-组件不存在
2.openEuler-22.03-LTS-SP3:不受影响-组件不存在
3.openEuler-22.03-LTS-SP4:不受影响-组件不存在
4.master(1.1.1m):不受影响-漏洞代码不能被攻击者触发
5.openEuler-24.03-LTS(1.1.1m):不受影响-漏洞代码不能被攻击者触发
6.openEuler-24.03-LTS-Next(1.1.1m):不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-SP1(1.1.1m):不受影响-漏洞代码不能被攻击者触发
8.openEuler-24.03-LTS-SP2(1.1.1m):不受影响-漏洞代码不能被攻击者触发

src-openEuler/compat-openssl11

内容风险标识

评论 (6)

src-openEuler/compat-openssl11 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2023-4807

评论 (6)

搜索帮助

src-openEuler/compat-openssl11