Correct the CHANGES entry for CVE-2023-1255

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/20798)

diff --git a/CHANGES.md b/CHANGES.md
index 9d4ace14055a4b847d0f8c6849d2554bb68f321b..60ef9febd79e3053c753568322a45dd46f371471 100644 (file)
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -271,9 +271,9 @@ OpenSSL 3.1
 ### Changes between 3.1.0 and 3.1.1 [xx XXX xxxx]
 
  * Fixed buffer overread in AES-XTS decryption on ARM 64 bit platforms which
-   happens if the buffer size is 4 mod 5. This can trigger a crash of an
-   application using AES-XTS decryption if the memory just after the buffer
-   being decrypted is not mapped.
+   happens if the buffer size is 4 mod 5 in 16 byte AES blocks. This can
+   trigger a crash of an application using AES-XTS decryption if the memory
+   just after the buffer being decrypted is not mapped.
    Thanks to Anton Romanov (Amazon) for discovering the issue.
    ([CVE-2023-1255])