Is CVE-2016-7544 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-7544 being exploited in the wild.

How severe is CVE-2016-7544?

High severity, with a CVSS score of 7.5, published 30 January 2017.

Which products and versions are affected?

Crypto++ Project Crypto++ 5.6.4.

Is there a fix for CVE-2016-7544?

A patch was published on 2016-10-11: Fixed in Crypto++ 5.6.5 release Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-7544 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2016-7544?

Check whether you run Microsoft Windows. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-7544: Crypto++ invalid memory deallocation in AES implementation

CVE-2016-7544 · Severity: high · CVSS 7.5 · Published 2017-01-30

Crypto++ is a widely used open-source library for cryptographic functions. A flaw in how the library manages memory on Windows systems can cause applications using it to crash. This could allow an attacker to disrupt services or cause a denial-of-service condition for software that relies on this library for encryption tasks.

Technologies: Microsoft Windows. Vendors: Microsoft.

Quick answers

Is CVE-2016-7544 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-7544 being exploited in the wild.
How severe is CVE-2016-7544?: High severity, with a CVSS score of 7.5, published 30 January 2017.
Which products and versions are affected?: Crypto++ Project Crypto++ 5.6.4.
Is there a fix for CVE-2016-7544?: A patch was published on 2016-10-11: Fixed in Crypto++ 5.6.5 release Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-7544 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2016-7544?: Check whether you run Microsoft Windows. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A memory management error exists in the AES implementation of Crypto++ 5.6.4 when compiled with Microsoft Visual C++ (_MSC_VER). The library utilizes _malloca to allocate memory and subsequently adjusts the pointer to a 256-byte boundary to align tables and mitigate cache timing attacks. However, the code incorrectly passes this adjusted pointer to _freea instead of the original pointer returned by _malloca. This violation of the _malloca/_freea contract leads to an invalid free operation, typically resulting in a heap corruption or application crash. The issue is specific to Windows environments and was resolved in version 5.6.5.

Affected products

Crypto++ Project Crypto++ 5.6.4

Timeline

2016-09-22: disclosed: Issue reported to oss-security mailing list
2016-09-23: advisory: CVE-2016-7544 assigned
2017-01-30: advisory: NVD publication date
2016-10-11: patched: Fixed in Crypto++ 5.6.5 release

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.