Bugzilla – Bug 1219217
VUL-0: CVE-2024-0914: openCryptoki: timing side-channel in handling of RSA PKCS#1 v1.5 padded ciphertexts (Marvin)
Last modified: 2024-07-20 19:10:08 UTC
Description: A timing side-channel in handling of RSA PKCS#1 v1.5 padded ciphertexts was discovered in the opencryptoki package. This side-channel can be used to perform RSA ciphertext decryption or signing without access to the private key. To achieve a successful decryption the attack would need to send a large amount of specifically crafted messages to a service that uses the vulnerable API. Fixed in: No fixed-in version yet, but a new release is expected in the next 3 weeks or so. Patches are already merged though. References: https://github.com/opencryptoki/opencryptoki/issues/731 https://github.com/opencryptoki/opencryptoki/pull/737 https://github.com/opencryptoki/opencryptoki/commit/2ea019ee2b09f15724d808382d53baca03403288 https://github.com/opencryptoki/opencryptoki/commit/7ffc0e135b4d923d686be536aa7bf69405a360a1 https://github.com/opencryptoki/opencryptoki/commit/c26e049bf40d656bc51429bad190b82fbf63f0c7 https://people.redhat.com/~hkario/marvin/ http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-0914 https://bugzilla.redhat.com/show_bug.cgi?id=2260407
Both commits from [0] and [1] are required to fully fix the issue. [0] https://github.com/opencryptoki/opencryptoki/pull/732 [1] https://github.com/opencryptoki/opencryptoki/pull/737
Tracking all codestreams affected for now: - SUSE:ALP:Source:Standard:1.0 - SUSE:SLE-11-SP4:Update - SUSE:SLE-12-SP2:Update - SUSE:SLE-12-SP3:Update - SUSE:SLE-12-SP4:Update - SUSE:SLE-12-SP5:Update - SUSE:SLE-15-SP1:Update - SUSE:SLE-15-SP2:Update - SUSE:SLE-15-SP3:Update - SUSE:SLE-15-SP4:Update - SUSE:SLE-15-SP5:Update - SUSE:SLE-15:Update
https://build.suse.de/request/show/320839 - SUSE:SLE-15-SP6:GA https://build.suse.de/request/show/320840 - SUSE:ALP:Source:Standard:1.0
SUSE-SU-2024:1447-1: An update that solves one vulnerability and contains two features can now be installed. Category: security (moderate) Bug References: 1219217 CVE References: CVE-2024-0914 Jira References: PED-3360, PED-3361 Maintenance Incident: [SUSE:Maintenance:32966](https://smelt.suse.de/incident/32966/) Sources used: Server Applications Module 15-SP5 (src): openCryptoki-3.23.0-150500.3.3.13 openSUSE Leap 15.5 (src): openCryptoki-3.23.0-150500.3.3.13 SUSE Linux Enterprise Micro 5.5 (src): openCryptoki-3.23.0-150500.3.3.13 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
The maintenance request for SLE 12 SP5 - https://build.suse.de/request/show/336080 - has been accepted. Resolving the ticket.
SUSE-SU-2024:2298-1: An update that solves one vulnerability and has one security fix can now be installed. Category: security (moderate) Bug References: 1219217, 1220266 CVE References: CVE-2024-0914 Maintenance Incident: [SUSE:Maintenance:34453](https://smelt.suse.de/incident/34453/) Sources used: SUSE Linux Enterprise Software Development Kit 12 SP5 (src): openCryptoki-3.17.0-5.9.2 SUSE Linux Enterprise High Performance Computing 12 SP5 (src): openCryptoki-3.17.0-5.9.2 SUSE Linux Enterprise Server 12 SP5 (src): openCryptoki-3.17.0-5.9.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): openCryptoki-3.17.0-5.9.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.