CVE-2016-2107: Infoleak
It was discovered that OpenSSL leaked timing information when decrypting TLS/SSL and DTLS protocol encrypted records when the connection used the AES CBC cipher suite and the server supported AES-NI. A remote attacker could possibly use this flaw to retrieve plain text from encrypted packets by using a TLS/SSL or DTLS server as a padding oracle.
Other sources
Quoting form the draft of OpenSSL upstream advisory:
Padding oracle in AES-NI CBC MAC check (CVE-2016-2107) ======================================================
Severity: High
A MITM attacker can use a padding oracle attack to decrypt traffic when the connection uses an AES CBC cipher and the server support AES-NI.
This issue was introduced as part of the fix for Lucky 13 padding attack (CVE-2013-0169). The padding check was rewritten to be in constant time by making sure that always the same bytes are read and compared against either the MAC or padding bytes. But it no longer checked that there was enough data to have both the MAC and padding bytes.
OpenSSL 1.0.2 users should upgrade to 1.0.2h OpenSSL 1.0.1 users should upgrade to 1.0.1t
This issue was reported to OpenSSL on 13th of April 2016 by Juraj Somorovsky. The fix was developed by Kurt Roeckx of the OpenSSL development team.
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2016-2107?
CVE-2016-2107 is classified as a medium severity vulnerability that allows potential information disclosure through timing attacks.
How do I fix CVE-2016-2107?
To remediate CVE-2016-2107, users must upgrade to OpenSSL version 1.0.1s or later, or 1.0.2 or later, depending on their specific installation.
Which OpenSSL versions are affected by CVE-2016-2107?
CVE-2016-2107 affects OpenSSL versions 1.0.1 through 1.0.1r and 1.0.2 through 1.0.2g.
Can CVE-2016-2107 be exploited remotely?
Yes, CVE-2016-2107 can be exploited by a remote attacker to retrieve plaintext from encrypted packets.
What are the potential impacts of CVE-2016-2107?
The potential impacts of CVE-2016-2107 include unauthorized access to sensitive information through the exploitation of a timing attack.