Integer Overflow Vulnerability in Keccak SHA-3 Implementation by XKCP
CVE-2022-37454

9.8CRITICAL

Key Information:

Vendor

Extended Keccak Code Package Project

Status
Extended Keccak Code Package
Vendor
CVE Published:
21 October 2022

What is CVE-2022-37454?

The Keccak XKCP SHA-3 reference implementation contains an integer overflow in the sponge function interface, which leads to a buffer overflow. This vulnerability allows attackers to execute arbitrary code or compromise the expected cryptographic properties of the hash function. It is crucial for developers and users of this implementation to be aware of these risks and apply necessary updates to ensure system integrity and security.

References

https://csrc.nist.gov/projects/hash-functions/sha-3-project
https://mouha.be/sha-3-buffer-overflow/
https://news.ycombinator.com/item?id=33281106

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.