Executive brief
mirage-crypto is a cryptographic library used by OCaml applications to encrypt and decrypt sensitive data. The AES-GCM, ChaCha20, and AES-CCM16 decryption functions release unverified plaintext to the caller's buffer before validating the authentication tag, allowing an attacker with a forged tag to read decrypted data that should be rejected. This violates the all-or-nothing property required of authenticated encryption and risks exposing sensitive data if the caller doesn't check the function's return value.
Technical details
The vulnerability affects the authenticate_decrypt_into functions in AES.GCM, AES.CCM16, and ChaCha20 modules, which implement AEAD (Authenticated Encryption with Associated Data) decryption. The root cause is that these functions write the decrypted plaintext into the caller-provided destination buffer first, then validate the authentication tag, returning a boolean to indicate success. An attacker can submit a ciphertext with a forged tag; the function returns false (indicating failure), but the plaintext has already been written to the buffer. This breaks the security property that AEAD decryption should be all-or-nothing: no plaintext is released until the tag verifies. A caller that reads the buffer without checking the return value processes forged-but-decrypted data. The fix (released in version 2.2.0) reorders the operations to validate the tag first, and only performs decryption into the buffer if validation succeeds; for CCM, the buffer is zeroed on tag failure. Attack vector is local (the attacker must supply the forged ciphertext to the library).
Affected products
- mirage-crypto mirage-crypto before 2.2.0
Timeline
- 2026-06-25: disclosed: Vulnerability reported to ocaml/security-advisories
- 2026-07-27: patched: mirage-crypto 2.2.0 released with fix
- 2026-07-27: advisory: Security advisory published