The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic…
Critical CVSS 9.8
Summary
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
- :
- :
- :
- :
- :
- :
- :
Sources
- NVD DATABASE
Original Links
- https://csrc.nist.gov/projects/hash-functions/sha-3-project Third Party Advisory
- https://eprint.iacr.org/2023/331
- https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658 Patch
- https://lists.debian.org/debian-lts-announce/2022/10/msg00041.html Mailing List
- https://lists.debian.org/debian-lts-announce/2022/11/msg00000.html Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ALQ6BDDPX5HU5YBQOBMDVAA2TSGDKIJ/ Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMIEXLMTW5GO36HTFFWIPB3OHZXCT3G4/ Mailing List
- https://mouha.be/sha-3-buffer-overflow/ Exploit
- https://news.ycombinator.com/item?id=33281106 Issue Tracking
- https://news.ycombinator.com/item?id=35050307
- https://security.gentoo.org/glsa/202305-02
- https://www.debian.org/security/2022/dsa-5267 Third Party Advisory
- https://www.debian.org/security/2022/dsa-5269 Third Party Advisory
- https://csrc.nist.gov/projects/hash-functions/sha-3-project Third Party Advisory
- https://eprint.iacr.org/2023/331
- https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658 Patch
- https://lists.debian.org/debian-lts-announce/2022/10/msg00041.html Mailing List
- https://lists.debian.org/debian-lts-announce/2022/11/msg00000.html Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ALQ6BDDPX5HU5YBQOBMDVAA2TSGDKIJ/ Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMIEXLMTW5GO36HTFFWIPB3OHZXCT3G4/ Mailing List
- https://mouha.be/sha-3-buffer-overflow/ Exploit
- https://news.ycombinator.com/item?id=33281106 Issue Tracking
- https://news.ycombinator.com/item?id=35050307
- https://security.gentoo.org/glsa/202305-02
- https://security.netapp.com/advisory/ntap-20230203-0001/
- https://www.debian.org/security/2022/dsa-5267 Third Party Advisory
- https://www.debian.org/security/2022/dsa-5269 Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/html/ssa-455250.html
- https://cert-portal.siemens.com/productcert/html/ssa-806742.html
Timeline
- nvd_ingest NVD