CVE-2023-26084
First published: Wed Mar 15 2023(Updated: )
The armv8_dec_aes_gcm_full() API of Arm AArch64cryptolib before 86065c6 fails to the verify the authentication tag of AES-GCM protected data, leading to a man-in-the-middle attack. This occurs because of an improperly initialized variable.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Arm AArch64cryptolib | <2023-02-20 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-26084.
What is the severity of CVE-2023-26084?
The severity of CVE-2023-26084 is low.
How does CVE-2023-26084 affect Arm AArch64cryptolib?
CVE-2023-26084 affects Arm AArch64cryptolib before version 86065c6.
What is the impact of CVE-2023-26084?
CVE-2023-26084 can result in a man-in-the-middle attack.
How can I fix CVE-2023-26084?
To fix CVE-2023-26084, update Arm AArch64cryptolib to version 86065c6 or later.
- collector/nvd-index
- vendor/arm
- product/aarch64cryptolib
- canonical/arm aarch64cryptolib