-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability (CVE-2023-5363) description clearly states that a bug in processing key and initialization vector (IV) lengths occurs when calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2(), or EVP_CipherInit_ex2(). Specifically, OSSL_PARAM array parameters like 'keylen' or 'ivlen' are processed after the key and IV have been established, leading to potential truncation or overruns. The provided patches (e.g., 0df40630850fb2740e6be6890bb905d3fc623b2d) modify the internal function evp_cipher_init_internal in crypto/evp/evp_enc.c. This function is called by the aforementioned EVP_*Init_ex2 functions. The patch to evp_cipher_init_internal adds logic to process the 'keylen' and 'ivlen' parameters from the OSSL_PARAM array before the main cipher initialization occurs. Therefore, evp_cipher_init_internal is the function that directly contained the flawed logic (order of operations). The EVP_EncryptInit_ex2, EVP_DecryptInit_ex2, and EVP_CipherInit_ex2 functions are the API entry points that expose this vulnerability by passing the OSSL_PARAM array to the flawed evp_cipher_init_internal (before it was patched). All these functions would appear in a runtime profile when the vulnerability is triggered.
A Semantic Attack on Google Gemini - Read the Latest Research