CVE-2019-11840

An integer overflow flaw was discovered in the amd64 assembly implementation of the Salsa20 and Salsa20/Salsa packages in the supplementary Go cryptography library, golang.org/x/crypto. The vulnerability, present in versions prior to commit b7391e95, causes the 32-bit counter used in keystream generation to wrap around. When more than 256 GiB of keystream is produced for a single key/nonce pair, or if the counter exceeds 32 bits through other means, the implementation first generates incorrect output and then cycles back to previously generated keystream bytes[1][2][3]. The root cause is a flaw in the amd64 assembly loops inherited from the SUPERCOP and NaCl distributions, where support for counters larger than 32 bits was an incomplete experiment[1][4]. Architectures other than amd64 are unaffected[1][4].

An attacker does not need to be authenticated or have special network access to exploit this condition; the vulnerability is triggered automatically when an application using the affected library processes very large messages or generates a large amount of keystream in a single salsa20.XORKeyStream invocation. The prerequisite is that the application must be built with the vulnerable amd64 assembly code and must produce or process more than 256 GiB of data under a single key/nonce combination. In practice, this can affect high-throughput encryption or CSPRNG usage patterns, as well as extremely large message encrypting applications[1][4].

The impact of this flaw is a loss of confidentiality. Because the keystream repeats, an attacker who can observe multiple ciphertexts generated with the same repeating keystream can recover the plaintext or perform other cryptanalytic attacks. In CSPRNG applications, the predictability undermines the security properties expected of a random number generator[1][3]. The issue was assigned a CVSS v3 score of 5.9 (Medium), reflecting the constrained exploitation scenario but serious consequences[1].

The fix was committed on 2019-03-19 and released in commit b7391e95e, which patches the amd64 assembly to correctly handle counter values larger than 32 bits[2][4]. Users of golang.org/x/crypto are advised to update to the latest version that includes this commit. Downstream projects such as Fedora packages (gomtree, source-to-image) and Red Hat products were also tracked for patching[3]. The upstream maintainers note that the same bug exists in SUPERCOP and NaCl, but those libraries do not consider it a problem due to their policy of not supporting counters larger than 32 bits[4].