Dan Ly
Facility Security Officer
Most Recent Tech Talk
Title CVE-2022-37454: A Buffer Overflow Vulnerability Affecting Implementations Of SHA-3 Date Thursday, May 16, 2024
Time 9:30 amSpeaker Nicky MouhaLocation Arlington, VAAbout Abstract: For over a decade, a buffer overflow vulnerability in the "official" SHA-3 implementation by its designers remained unnoticed. This vulnerability was assigned CVE-2022-37454 and impacted several projects such as Python and PHP that relied on this implementation. We provide a proof of concept for arbitrary code execution and explain how we found the vulnerability using the KLEE symbolic execution tool. In light of the upcoming NIST Workshop on Formal Methods within Certification Programs (FMCP 2024), we give an overview of various approaches to mitigate these types of bugs in cryptographic implementations and discuss both their cost and effectiveness.
Portland, OR
421 SW 6th Avenue, Suite 300 Arlington, VA
901 N Stuart Street, Suite 501 Minneapolis, MN
111 Third Avenue South, Suite 350 Dayton, OH
444 E 2nd Street contact@galois.com
