OpenSSL Security Advisory [6th November 2023]
=============================================

Excessive time spent in DH check / generation with large Q parameter value (CVE-2023-5678)
==========================================================================================

Severity: Low

Issue summary: Generating excessively long X9.42 DH keys or checking
excessively long X9.42 DH keys or parameters may be very slow.

Impact summary: Applications that use the functions DH_generate_key() to
generate an X9.42 DH key may experience long delays.  Likewise, applications
that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check()
to check an X9.42 DH key or X9.42 DH parameters may experience long delays.
Where the key or parameters that are being checked have been obtained from
an untrusted source this may lead to a Denial of Service.

While DH_check() performs all the necessary checks (as of CVE-2023-3817),
DH_check_pub_key() doesn't make any of these checks, and is therefore
vulnerable for excessively large P and Q parameters.

Likewise, while DH_generate_key() performs a check for an excessively large
P, it doesn't check for an excessively large Q.

An application that calls DH_generate_key() or DH_check_pub_key() and
supplies a key or parameters obtained from an untrusted source could be
vulnerable to a Denial of Service attack.

DH_generate_key() and DH_check_pub_key() are also called by a number of
other OpenSSL functions.  An application calling any of those other
functions may similarly be affected.  The other functions affected by this
are DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate().

Also vulnerable are the OpenSSL pkey command line application when using the
"-pubcheck" option, as well as the OpenSSL genpkey command line application.

The OpenSSL SSL/TLS implementation is not affected by this issue.

The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.

OpenSSL 3.1, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.

Due to the low severity of this issue we are not issuing new releases of
OpenSSL at this time. The fix will be included in the next releases when they
become available.
The fix is also available in commit ddeb4b6c6d527e54ce9a99cba785c0f7776e54b6
(for 3.1) and commit db925ae2e65d0d925adef429afc37f75bd1c2017 (for 3.0).
It is available to premium support customers in commit
710fee740904b6290fef0dd5536fbcedbc38ff0c (for 1.1.1) and in commit
34efaef6c103d636ab507a0cc34dca4d3aecc055 (for 1.0.2). 

This issue was reported on 16th August 2023 by David Benjamin (Google). The
fix was developed by Richard Levitte.

In reply to @hexa:lossy.network
https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20231114

Name of the issue: Redundant Prefix Issue

Description of the issue
Under certain microarchitectural conditions, Intel has identified cases
where execution of an instruction (REP MOVSB) encoded with a redundant
REX prefix may result in unpredictable system behavior resulting in a
system crash/hang, or, in some limited scenarios, may allow escalation
of privilege from CPL3 to CPL0.
This Redundant Prefix Issue is assigned CVE-2023-23583 with a CVSS Base
Score of 8.8 High CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.