NetSight
IP …
critical9.8

CVE-2022-37454

Buffer overflow in sponge queue functions

Impact

### Impact The Keccak sponge function interface accepts partial inputs to be absorbed and partial outputs to be squeezed. A buffer can overflow when partial data with some specific sizes are queued, where at least one of them has a length of 2^32 - 200 bytes or more. ### Patches Yes, see commit [fdc6fef0](https://github.com/XKCP/XKCP/commit/fdc6fef075f4e81d6b1bc38364248975e08e340a). ### Workarounds The problem can be avoided by limiting the size of the partial input data (or partial output digest) below 2^32 - 200 bytes. Multiple calls to the queue system can be chained at a higher level to retain the original functionality. Alternatively, one can process the entire input (or produce the entire output) at once, avoiding the queuing functions altogether. ### References See [issue #105](https://github.com/XKCP/XKCP/issues/105) for more details.

Affected packages

EcosystemPackageAffectedFixed in
pippysha3<= 1.0.2none recorded
rubygemssha3< 1.0.51.0.5

Affected products

VendorProductAffected versions
Extended Keccak Code Package ProjectExtended Keccak Code Package
All versions
DebianDebian Linux
Versions 10.0, 11.0
FedoraprojectFedora
Versions 35, 36
PhpPhp
from 7.2.0 before 7.4.33
from 8.0.0 before 8.0.25
from 8.1.0 before 8.1.12
PythonPython
from 3.6.0 before 3.7.16
from 3.8.0 before 3.8.16
from 3.9.0 before 3.9.16
from 3.10.0 before 3.10.9
Sha3 ProjectSha3
before 1.0.5
Pysha3 ProjectPysha3
All versions
PypyPypy
from 7.0.0

Weakness classification

CWE-190

References