CVE-2018-0495: Infoleak
An implementation flaw was discovered in multiple cryptographic libraries that allows a side-channel based attacker to recover ECDSA or DSA private keys. When these cryptographic libraries use the private key to create a signature, such as for a TLS or SSH connection, they inadvertently leak information through memory caches. An unprivileged attacker running on the same machine can collect the information from a few thousand signatures and recover the value of the private key.
External References:
https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/
Other sources
Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the gcryeccecdsasign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/jbcs-httpd24-httpdto a version that resolves this vulnerability.Fixed in 0:2.4.29-40.jbcs.el6 - Upgrade
Upgrade
redhat/jbcs-httpd24-opensslto a version that resolves this vulnerability.Fixed in 1:1.0.2n-15.jbcs.el6 - Upgrade
Upgrade
redhat/jbcs-httpd24-httpdto a version that resolves this vulnerability.Fixed in 0:2.4.29-40.jbcs.el7 - Upgrade
Upgrade
redhat/jbcs-httpd24-opensslto a version that resolves this vulnerability.Fixed in 1:1.0.2n-15.jbcs.el7 - Upgrade
Upgrade
redhat/opensslto a version that resolves this vulnerability.Fixed in 1:1.0.2k-16.el7 - Upgrade
Upgrade
redhat/nsprto a version that resolves this vulnerability.Fixed in 0:4.21.0-1.el7 - Upgrade
Upgrade
redhat/nssto a version that resolves this vulnerability.Fixed in 0:3.44.0-4.el7 - Upgrade
Upgrade
redhat/nss-softoknto a version that resolves this vulnerability.Fixed in 0:3.44.0-5.el7 - Upgrade
Upgrade
redhat/nss-utilto a version that resolves this vulnerability.Fixed in 0:3.44.0-3.el7 - Upgrade
Upgrade
redhat/nss-softoknto a version that resolves this vulnerability.Fixed in 0:3.28.3-9.el7_4 - Upgrade
Upgrade
redhat/nss-softoknto a version that resolves this vulnerability.Fixed in 0:3.36.0-6.el7_5 - Upgrade
Upgrade
redhat/nss-softoknto a version that resolves this vulnerability.Fixed in 0:3.36.0-6.el7_6 - Upgrade
Upgrade
debian/libgcrypt20to a version that resolves this vulnerability.Fixed in 1.10.1-3+deb12u1Fixed in 1.11.0-7+deb13u1Fixed in 1.12.4-2 - Upgrade
Upgrade
Libgcryptto a version that resolves this vulnerability.Fixed in 1.7.10 - Upgrade
Upgrade
Libgcryptto a version that resolves this vulnerability.Fixed in 1.8.3 - Compensating control
Use blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2018-0495?
CVE-2018-0495 is rated as high severity due to the potential for private key recovery through a side-channel attack.
How do I fix CVE-2018-0495?
To mitigate CVE-2018-0495, update to the fixed versions of the affected packages listed in the vulnerability report.
Which software is affected by CVE-2018-0495?
CVE-2018-0495 affects several cryptographic libraries including jbcs-httpd24-httpd and jbcs-httpd24-openssl among others.
What type of attack does CVE-2018-0495 enable?
CVE-2018-0495 enables a side-channel attack that can lead to the recovery of ECDSA or DSA private keys.
Is CVE-2018-0495 limited to specific operating systems?
CVE-2018-0495 affects multiple operating systems, including various versions of Red Hat Enterprise Linux and Debian.