AEADs/aes-gcm: Plaintext exposed in decrypt_in_place_detached even on tag verification failure

Vulnerability

Description The AES-GCM implementation in the aes-gcm Rust crate (versions 0.10.0 to 0.10.2) suffers from a critical flaw in the decrypt_in_place_detached function. When tag verification fails, the decrypted ciphertext (i.e., plaintext) remains in the buffer instead of being cleared before returning an error [1][3]. This contradicts the NIST GCM specification, which states that plaintext should only be returned if the tag matches [4].

Exploitation

An attacker who can provide a manipulated ciphertext to an application using this API can trigger a failed decryption. If the application then accesses the buffer (e.g., for error handling or logging), the unauthenticated plaintext is exposed. This requires the attacker to have the ability to inject or control the ciphertext input, typically over a network or via file upload [2].

Impact

Exposure of the decrypted data enables Chosen Ciphertext Attacks (CCAs), potentially allowing full recovery of the plaintext. This undermines the integrity guarantees of AES-GCM, as an attacker can iteratively modify ciphertexts and observe the 'decrypted' output to extract secrets [3][4]. The impact is severe in scenarios requiring authenticated encryption, such as secure communications or data storage.

Mitigation

The issue is fixed in version 0.10.3 of the aes-gcm crate [3]. Users should update immediately. As a workaround, applications must ensure that after a decryption failure, the buffer is not used; however, relying on this is error-prone. No known evidence of active exploitation has been reported as of the advisory date [2].