Executive brief
Crypto++ is a widely used open-source library for cryptographic functions. A flaw in how the library manages memory on Windows systems can cause applications using it to crash. This could allow an attacker to disrupt services or cause a denial-of-service condition for software that relies on this library for encryption tasks.
Technical details
A memory management error exists in the AES implementation of Crypto++ 5.6.4 when compiled with Microsoft Visual C++ (_MSC_VER). The library utilizes _malloca to allocate memory and subsequently adjusts the pointer to a 256-byte boundary to align tables and mitigate cache timing attacks. However, the code incorrectly passes this adjusted pointer to _freea instead of the original pointer returned by _malloca. This violation of the _malloca/_freea contract leads to an invalid free operation, typically resulting in a heap corruption or application crash. The issue is specific to Windows environments and was resolved in version 5.6.5.
Affected products
- Crypto++ Project Crypto++ 5.6.4
Timeline
- 2016-09-22: disclosed: Issue reported to oss-security mailing list
- 2016-09-23: advisory: CVE-2016-7544 assigned
- 2017-01-30: advisory: NVD publication date
- 2016-10-11: patched: Fixed in Crypto++ 5.6.5 release