CVE-2025-69418

Description

The vulnerability resides in the low-level OCB encrypt and decrypt routines (CRYPTO_ocb128_encrypt() and CRYPTO_ocb128_decrypt()) when using hardware-accelerated code paths such as AES-NI. When processing input whose length is not a multiple of 16 bytes, the routines correctly encrypt or decrypt full 16-byte blocks via the hardware stream function, but the input and output pointers are not advanced after processing those full blocks [3][4]. Consequently, the subsequent tail-handling code then operates on the original buffer start, effectively leaving the actual trailing bytes (the final 1–15 bytes) unprocessed bytes) unencrypted on encryption and unauthenticated on both encryption and decryption. The authentication checksum also excludes these true tail bytes, so an attacker can tamper with them without detection [2].

Exploitation

The attack surface is narrow: typical OpenSSL consumers using the EVP interface or the OpenSSL provider OCB implementation are not affected because those higher-level layers split inputs so that full blocks and trailing partial blocks are processed in separate calls, avoiding the problematic code path [2]. Additionally, TLS does not use OCB ciphersuites. Therefore, only applications that call the low-level OCB API directly with a single input that is not a multiple of 16 bytes, and run on builds that use hardware acceleration (e.g., AES-NI), are vulnerable. No special network position or authentication is required beyond the ability to supply such misaligned data to the vulnerable functions [2].

Impact

An attacker exploiting this issue can read the trailing 1–15 bytes of a message in cleartext (instead of ciphertext) when encryption is performed, and can modify those bytes without the authentication tag reflecting the change. This defeats the confidentiality and integrity guarantees of OCB mode for those bytes, potentially leaking sensitive data or allowing undetected tampering with the tail of a message. The vulnerability has been assessed as Low severity by the OpenSSL project due to the limited attack surface [2].

Mitigation

OpenSSL versions 3.6, 3.5, 3.4, 3.3, 3.0, and 1.1.1 are vulnerable; OpenSSL 1.0.2 is not affected [2]. The fix is provided in commits for the affected versions, adding a processed_bytes variable and correctly advancing the in and out pointers after the hardware stream call [3][4]. Siemens has also listed this CVE listed as affecting the SIMATIC S7-1500 TM MFP - GNU/Linux subsystem, although no specific remediation is yet listed [1]. Users are advised to update to the latest OpenSSL releases (3.6.1, 3.5.5, 3.4.4, etc.) or apply the patch [2].