Linux kernel (WireGuard): poly1305_update wraps buflen plus nbytes in 32 bits and writes out of bounds
Fixed · low · Memory-safety bug
If one poly1305_update call has nbytes at least 2^32 minus buflen, with 1 to 15 bytes buffered, it writes about 4 GiB out of bounds. The write corrupts memory over the 16-byte buffer of poly1305_desc_ctx, and no in-tree caller can do that.
Found: ; reported: ; status since: . Reporter: genproof team
Page for this report · Public report · Fix or proposed fix (see status)