Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 856592 (CVE-2022-2097) - <dev-libs/openssl-{1.1.1q, 3.0.5}: broken AES-OCB encryption on x86
Summary: <dev-libs/openssl-{1.1.1q, 3.0.5}: broken AES-OCB encryption on x86
Status: IN_PROGRESS
Alias: CVE-2022-2097
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://www.openssl.org/news/secadv/2...
Whiteboard: B3 [glsa?]
Keywords:
Depends on: 858143
Blocks:
  Show dependency tree
 
Reported: 2022-07-05 16:16 UTC by John Helmert III
Modified: 2022-08-29 21:36 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-07-05 16:16:28 UTC
CVE-2022-2097:

AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p).

https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=a98f339ddd7e8f487d6e0088d4a9a42324885a93
https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=919925673d6c9cfed3c1085497f5dfbbed5fc431
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-07-05 22:57:05 UTC
commit db6f7217c034a620288ea0ef95227707c3fb55ea
Author: Mike Gilbert <floppym@gentoo.org>
Date:   Tue Jul 5 18:13:46 2022 -0400

    dev-libs/openssl: add 3.0.5

    Signed-off-by: Mike Gilbert <floppym@gentoo.org>
Comment 2 Larry the Git Cow gentoo-dev 2022-07-05 23:33:33 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1f171e1acbd185d7cd5c5a2689f50d02c7c64caf

commit 1f171e1acbd185d7cd5c5a2689f50d02c7c64caf
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2022-07-05 23:33:03 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-07-05 23:33:03 +0000

    dev-libs/openssl: add 1.1.1q
    
    Bug: https://bugs.gentoo.org/856592
    Signed-off-by: Sam James <sam@gentoo.org>

 dev-libs/openssl/Manifest                          |   2 +
 .../openssl/files/openssl-3.0.5-test-memcmp.patch  |   2 +
 dev-libs/openssl/openssl-1.1.1q.ebuild             | 337 +++++++++++++++++++++
 3 files changed, 341 insertions(+)
Comment 3 Larry the Git Cow gentoo-dev 2022-08-29 21:13:13 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=458daf054634ccaa6e5df1a53339e0f57f2755a6

commit 458daf054634ccaa6e5df1a53339e0f57f2755a6
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2022-08-29 20:51:15 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-08-29 20:51:41 +0000

    dev-libs/openssl: drop 1.1.1n, 1.1.1o, 1.1.1o-r1, 1.1.1p
    
    Bug: https://bugs.gentoo.org/856592
    Bug: https://bugs.gentoo.org/842489
    Signed-off-by: Sam James <sam@gentoo.org>

 dev-libs/openssl/Manifest                          |   7 -
 .../files/openssl-1.1.1p-fix-test-build.patch      |  52 ----
 dev-libs/openssl/openssl-1.1.1n.ebuild             | 298 ------------------
 dev-libs/openssl/openssl-1.1.1o-r1.ebuild          | 338 ---------------------
 dev-libs/openssl/openssl-1.1.1o.ebuild             | 318 -------------------
 dev-libs/openssl/openssl-1.1.1p.ebuild             | 337 --------------------
 6 files changed, 1350 deletions(-)