CVE-2016-6129: Input Validation
It has been reported that libtomcrypt may be vulnerable to a Bleichenbacher attack due to a vulnerability in rsaverifyhash.c
CERT has provided the details from Intel Security Advanced Threat Research team. ---------------------------------------------------------------------- Bleichenbacher signature forgery attack in OP-TEE Background The implementation for RSA signature verification of PKCS 1 v1.5 in the Open Portable Trusted Execution Environment (https://github.com/OP-TEE/opteeos) appears to be vulnerable to a Bleichenbacher signature forgery attack. The vulnerability may result in RSA signature or public certificate forgery when a low public exponent (for example, e = 3) is used. Vulnerability The function rsaverifyhashex (https://github.com/OPTEE/opteeos/blob/master/core/lib/libtomcrypt/src/pk/rsa/rsaverifyhash.c) does not check the number of remaining bytes in the decrypted message after ASN.1 encoded data. The function decodes the ASN.1 message and checks that it has the correct structure and values (OID and hash). This permits additional data after the ASN.1 message that can be used to forge a PKCS1 v1.5 signature for keys with a low public exponent. The original variant of the attack is described here: https://www.ietf.org/mail-archive/web/openpgp/current/msg00999.html
----------------------------------------------------------------------
Other sources
The rsaverifyhashex function in rsaverifyhash.c in LibTomCrypt, as used in OP-TEE before 2.2.0, does not validate that the message length is equal to the ASN.1 encoded data length, which makes it easier for remote attackers to forge RSA signatures or public certificates by leveraging a Bleichenbacher signature forgery attack.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-6129?
CVE-2016-6129 is classified as a medium severity vulnerability due to its potential exploitation via a Bleichenbacher attack.
What software is affected by CVE-2016-6129?
CVE-2016-6129 affects libtomcrypt versions up to 1.17 and OP-TEE OS versions up to 2.1.0.
How do I fix CVE-2016-6129?
To fix CVE-2016-6129, update libtomcrypt to a later version beyond 1.17 and OP-TEE OS to a later version than 2.1.0.
What is the nature of the vulnerability in CVE-2016-6129?
CVE-2016-6129 involves a flaw in rsa_verify_hash.c that may allow for a Bleichenbacher attack, compromising RSA signature verification.
Is there a workaround for CVE-2016-6129 if I cannot update?
There are no known effective workarounds for CVE-2016-6129, so it is recommended to apply the necessary updates.