CVE-2016-6489: High severity red hat enterprise linux desktop vulnerability
A cache-related side channel was found in nettle's RSA and DSA decryption code. An attacker could use this flaw to recover the private key, from a co-located virtual-machine instance.
References:
https://eprint.iacr.org/2016/596.pdf https://git.lysator.liu.se/nettle/nettle/commit/3fe1d6549765ecfb24f0b80b2ed086fdc818bff3
Other sources
The RSA and DSA decryption code in Nettle makes it easier for attackers to discover private keys via a cache side channel attack.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-6489?
CVE-2016-6489 has been classified as a high severity vulnerability due to the potential for private key recovery.
How do I fix CVE-2016-6489?
To fix CVE-2016-6489, update the Nettle library to a version higher than 3.3.
Who is affected by CVE-2016-6489?
CVE-2016-6489 affects users of Nettle versions up to but not including 3.4 on specific distributions like RHEL 7.0 and several versions of Ubuntu.
What kind of attack can exploit CVE-2016-6489?
An attack exploiting CVE-2016-6489 involves recovering private keys through a cache-related side channel in a virtualized environment.
Is CVE-2016-6489 relevant in cloud environments?
Yes, CVE-2016-6489 is particularly relevant in cloud environments where multiple virtual machines may share the same physical resources.