CVE-2023-1255 Input buffer over-read in AES-XTS implementation on 64 bit ARM

Medium 5.9 Published 20 Apr 2023 Updated 13 Feb 2025

An attacker controlling ciphertext size on 64-bit ARM can trigger a buffer over-read in OpenSSL's AES-XTS decryption, causing a denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-1255?

CVE-2023-1255 is a medium-severity memory corruption vulnerability in Openssl Openssl, published on 20 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM platform contains a bug that could cause it to read past the input buffer, leading to a crash.

Impact summary: Applications that use the AES-XTS algorithm on the 64 bit ARM platform can crash in rare circumstances. The AES-XTS algorithm is usually used for disk encryption.

The AES-XTS cipher decryption implementation for 64 bit ARM platform will read past the end of the ciphertext buffer if the ciphertext size is 4 mod 5 in 16 byte blocks, e.g. 144 bytes or 1024 bytes. If the memory after the ciphertext buffer is unmapped, this will trigger a crash which results in a denial of service.

If an attacker can control the size and location of the ciphertext buffer being decrypted by an application using AES-XTS on 64 bit ARM, the application is affected. This is fairly unlikely making this issue a Low severity one.

Weakness: CWE-125

Which versions are affected by CVE-2023-1255?

It affects 1 product.

Products include Openssl Openssl.

How do I fix CVE-2023-1255?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2023-1255 being exploited?

There is no known exploitation of CVE-2023-1255 in the wild and no public exploit code.

All Openssl Openssl vulnerabilities

Sources

Also known as ALPINE-CVE-2023-1255, CLEANSTART-2026-MN08707, DEBIAN-CVE-2023-1255, GHSA-4wp2-xw7p-2gfx, JLSEC-2026-238, UBUNTU-CVE-2023-1255.