Billy Brumley

Setting an AES-GCM-SIV IV shorter than the expected nonce length via the `EVP CipherInit ex()` function (or equivalent provider cipher initialization) may trigger a heap out-of-bounds read. This occurs because the software copies the caller-supplied IV into its internal state using the expected nonce size instead of the actual length provided. If a longer IV is supplied, the implementation silently truncates the trailing bytes instead of rejecting the input. This truncation breaks the binding between the IV and the authentication tag, allowing an attacker who knows a message and its tag to forge messages under a different IV if the initial bytes match. The issue specifically affects applications using an IV length other than the standard 12 bytes for AES-GCM-SIV. The out-of-bounds read is processed within the `ossl aes gcm siv init()` function.

Decryption using ChaCha20-Poly1305 and AES-OCB ciphers may report success without verifying the authentication tag when an empty ciphertext is processed via the `EVP Cipher()` function. This occurs because the function skips the AEAD (Authenticated Encryption with Associated Data) tag verification in these specific cases. Consequently, applications relying on the return value of `EVP Cipher()` to confirm message integrity may accept forged messages.

A elevation of privilege vulnerability exists in the Android media framework, specifically in libstagefright.

A timing attack flaw was found in OpenSSL that could allow a malicious user with local access to recover ECDSA P-256 private keys. The vulnerability is related to errors in cryptographic key management, which can be exploited to restore closed keys.

The issue is related to the `dsa sign setup` function in OpenSSL, which does not ensure the use of constant-time operations. This makes it easier for local users to discover a DSA private key via a timing side-channel attack. The vulnerability can allow an attacker to recover the DSA private key under certain conditions, potentially affecting SSH servers that use DSA keys.