Mirage Crypto
Monthly
Authenticated decryption in mirage-crypto before 2.2.0 for OCaml violates the security invariant of AEAD schemes by writing decrypted plaintext into the caller-supplied output buffer before the authentication tag is verified. When a forged tag is detected, `AES.GCM.authenticate_decrypt_into` and `Chacha20.authenticate_decrypt_into` return `false`, but the destination buffer already contains the full unverified plaintext. Applications that process buffer contents without rigidly checking the boolean return value - or where timing or compiler behavior creates subtle access windows - may consume attacker-controlled forged plaintext as if it were authenticated. No public exploit or KEV listing has been identified at time of analysis.
Authenticated decryption in mirage-crypto before 2.2.0 for OCaml violates the security invariant of AEAD schemes by writing decrypted plaintext into the caller-supplied output buffer before the authentication tag is verified. When a forged tag is detected, `AES.GCM.authenticate_decrypt_into` and `Chacha20.authenticate_decrypt_into` return `false`, but the destination buffer already contains the full unverified plaintext. Applications that process buffer contents without rigidly checking the boolean return value - or where timing or compiler behavior creates subtle access windows - may consume attacker-controlled forged plaintext as if it were authenticated. No public exploit or KEV listing has been identified at time of analysis.