CVE-2023-6129

Issue summary: The POLY1305 MAC (message authentication code) implementation<br /> contains a bug that might corrupt the internal state of applications running<br /> on PowerPC CPU based platforms if the CPU provides vector instructions.<br /> <br /> Impact summary: If an attacker can influence whether the POLY1305 MAC<br /> algorithm is used, the application state might be corrupted with various<br /> application dependent consequences.<br /> <br /> The POLY1305 MAC (message authentication code) implementation in OpenSSL for<br /> PowerPC CPUs restores the contents of vector registers in a different order<br /> than they are saved. Thus the contents of some of these vector registers<br /> are corrupted when returning to the caller. The vulnerable code is used only<br /> on newer PowerPC processors supporting the PowerISA 2.07 instructions.<br /> <br /> The consequences of this kind of internal application state corruption can<br /> be various - from no consequences, if the calling application does not<br /> depend on the contents of non-volatile XMM registers at all, to the worst<br /> consequences, where the attacker could get complete control of the application<br /> process. However unless the compiler uses the vector registers for storing<br /> pointers, the most likely consequence, if any, would be an incorrect result<br /> of some application dependent calculations or a crash leading to a denial of<br /> service.<br /> <br /> The POLY1305 MAC algorithm is most frequently used as part of the<br /> CHACHA20-POLY1305 AEAD (authenticated encryption with associated data)<br /> algorithm. The most common usage of this AEAD cipher is with TLS protocol<br /> versions 1.2 and 1.3. If this cipher is enabled on the server a malicious<br /> client can influence whether this AEAD cipher is used. This implies that<br /> TLS server applications using OpenSSL can be potentially impacted. However<br /> we are currently not aware of any concrete application that would be affected<br /> by this issue therefore we consider this a Low severity security issue.