CyberRota Analysis
AI-GeneratedA vulnerability in libkcapi affects applications performing one-shot symmetric cipher operations with large inputs (over 64 KiB) in stateful modes like CTR or CBC, where the Initialization Vector (IV) is improperly reused. This flaw can be exploited by remote attackers to weaken data confidentiality and potentially compromise data integrity, as it may reveal relationships in the encrypted plaintext. Organizations utilizing libkcapi for cryptographic operations should prioritize addressing this vulnerability to safeguard sensitive data.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs (over 64 KiB) in stateful modes such as Counter (CTR) or Cipher Block Chaining (CBC), the library improperly reuses the Initialization Vector (IV) for each internal data chunk. A remote attacker could potentially exploit this by making an application that uses libkcapi process specially crafted large inputs. This can lead to a significant weakening of data confidentiality, as the repeated IV use can expose relationships in encrypted plaintext, and may also affect data integrity by causing incorrect cryptographic processing.
Related CVEs
Other vulnerabilities affecting the same vendor(s)