Microsoft security update for CVE-2023-6129
🔗 CVE IDs covered (1)
📋 Microsoft's advisory
EchelonGraph does not copy Microsoft's advisory page: its FAQ and remediation text are not shown here. Read the advisory on https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-6129. This page also shows what EchelonGraph holds for CVE-2023-6129, with the description from its CVE record, which the CVE Numbering Authority that assigned the CVE wrote: for a CVE Microsoft assigned, often in the words of Microsoft's own advisory.
🎯 Affected products11
- azl3 cloud-hypervisor-cvm 38.0.72-2 on Azure Linux 3.0
- azl3 cloud-hypervisor-cvm 38.0.72.2-1 on Azure Linux 3.0
- azl3 edk2 20240524git3e722403cd16-8 on Azure Linux 3.0
- azl3 nodejs 20.10.0-2 on Azure Linux 3.0
- azl3 nodejs 20.14.0-1 on Azure Linux 3.0
- azl3 openssl 3.1.4-9 on Azure Linux 3.0
- azl3 openssl 3.3.0-1 on Azure Linux 3.0
- cbl2 cloud-hypervisor-cvm 38.0.72-1 on CBL Mariner 2.0
- cbl2 cloud-hypervisor-cvm 38.0.72.2-1 on CBL Mariner 2.0
- cbl2 hvloader 1.0.1-5 on CBL Mariner 2.0
- cbl2 hvloader 1.0.1-6 on CBL Mariner 2.0
✅ Updates Microsoft lists: 5 updates
5 rows: one per KB article or update, update type and fixed build. Their details are on Microsoft's advisory.
| KB article | Update | Fixed build |
|---|---|---|
| — | Security Update | 3.3.0-1 |
| — | Security Update | 1.0.1-6 |
| — | Security Update | - |
| — | Security Update | 20.14.0-1 |
| — | Security Update | 38.0.72.2-1 |
🧭 EchelonGraph on CVE-2023-6129
- EchelonGraph score
- 6.5 MEDIUM
- CISA KEV
- Not listed
- Fix status
- A fix is available — apply it.
Description from the CVE record (CVE.org), as published by its numbering authority
Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instructions. Impact summary: If an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences. The POLY1305 MAC (message authentication code) implementation in OpenSSL for PowerPC CPUs restores the contents of vector registers in a different order than they are saved. Thus the contents of some of these vector registers are corrupted when returning to the caller. The vulnerable code is used only on newer PowerPC processors supporting the PowerISA 2.07 instructions. The consequences of this kind of internal application state corruption can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However unless the compiler uses the vector registers for storing pointers, the most likely consequence, if any, would be an incorrect result of some application dependent calculations or a crash leading to a denial of service. The POLY1305 MAC algorithm is most frequently used as part of the CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of this AEAD cipher is with TLS protocol versions 1.2 and 1.3. If this cipher is enabled on the server a malicious client can influence whether this AEAD cipher is used. This implies that TLS server applications using OpenSSL can be potentially impacted. However we are currently not aware of any concrete application that would be affected by this issue therefore we consider this a Low severity security issue.
Published by OpenSSL Software Foundation, the CVE Numbering Authority that assigned CVE-2023-6129, in its CVE record at CVE.org; reused under the CVE Program's Terms of Use (its licence and MITRE's copyright notice are in our Terms of Service).