Correct the CHANGES entry for CVE-2023-1255

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/20798)

(cherry picked from commit e6990079c2413625d2039ebed49ea17a5b8cf935)

diff --git a/CHANGES.md b/CHANGES.md
index 7784b4966fbcf7a26ed8179f47793423c1005d79..64bdcf4ba3e1b9444a18fb1cd4f3c3074c073aaa 100644 (file)
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -25,9 +25,9 @@ OpenSSL 3.1
 ### Changes between 3.1.0 and 3.1.1 [xx XXX xxxx]
 
  * Fixed buffer overread in AES-XTS decryption on ARM 64 bit platforms which
-   happens if the buffer size is 4 mod 5. This can trigger a crash of an
-   application using AES-XTS decryption if the memory just after the buffer
-   being decrypted is not mapped.
+   happens if the buffer size is 4 mod 5 in 16 byte AES blocks. This can
+   trigger a crash of an application using AES-XTS decryption if the memory
+   just after the buffer being decrypted is not mapped.
    Thanks to Anton Romanov (Amazon) for discovering the issue.
    ([CVE-2023-1255])