CVE-2023-6129

What it actually does

The POLY1305 MAC implementation on PowerPC CPUs supporting PowerISA 2.07 incorrectly restores vector register contents, corrupting non-volatile registers on return and potentially altering application state or control flow when the algorithm is invoked.

Why it matters to the business

Organizations running OpenSSL-based TLS services on affected PowerPC hardware face a low-probability risk of service crashes or incorrect cryptographic results that could disrupt encrypted communications or lead to application-specific failures; the issue has low exploit maturity and no known active campaigns.

How an attack unfolds

An attacker connects to a TLS server that supports CHACHA20-POLY1305 and forces negotiation of that cipher suite; the subsequent POLY1305 computation on the PowerPC server triggers the register restore bug, leaving corrupted state that may cause a crash or, in rare cases where pointers reside in the affected registers, arbitrary code execution.

How to fix it

Upgrade OpenSSL to the commit 050d26383d4e264966fb83428e72d5d48f402d35 or later releases that contain the corrected vector-register save/restore sequence; rebuild and redeploy all dependent applications and libraries; disable CHACHA20-POLY1305 on PowerPC systems if immediate patching is not feasible.

How to confirm the fix worked

Confirm the deployed OpenSSL binary or source contains commit 050d26383d4e264966fb83428e72d5d48f402d35; run regression tests exercising CHACHA20-POLY1305 on PowerPC hardware and verify absence of register corruption or crashes; monitor build logs for the corrected assembly routines.

Typical attack path

1. Identify TLS servers advertising CHACHA20-POLY1305 support
2. Initiate a handshake and steer cipher negotiation to CHACHA20-POLY1305
3. Trigger POLY1305 processing during record encryption or authentication
4. Observe resulting process crash, denial of service, or unexpected application behavior

How to detect it

Search application and TLS logs for unexpected crashes or authentication failures immediately after CHACHA20-POLY1305 handshakes on PowerPC systems; review core dumps or register traces for signs of vector-register corruption following POLY1305 calls.

What your security team should do

• Prioritize patching PowerPC systems that expose TLS endpoints using OpenSSL
• Inventory all applications linking against OpenSSL and schedule upgrades to the fixed commit
• Temporarily disable CHACHA20-POLY1305 cipher suites on PowerPC hosts until patches are applied
• Update vulnerability scanners and SBOM tools with the corrected OpenSSL version