CVE-2023-4421: Medium severity ibm cognos analytics vulnerability

Mozilla Network Security Services (NSS), as used in Mozilla Firefox, could allow a remote authenticated attacker to obtain sensitive information, caused by a timing attack in the RSA operations due to incorrect cryptographic implementation. By using new tlsfuzzer code, an attacker could exploit this vulnerability to obtain sensitive information on the system.

— IBM

The NSS code used for checking PKCS#1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks. Both the overall correctness of the padding as well as the length of the encrypted message was leaking through timing side-channel. By sending large number of attacker-selected ciphertexts, the attacker would be able to decrypt a previously intercepted PKCS#1 v1.5 ciphertext (for example, to decrypt a TLS session that used RSA key exchange), or forge a signature using the victim's key. The issue was fixed by implementing the implicit rejection algorithm, in which the NSS returns a deterministic random message in case invalid padding is detected, as proposed in the Marvin Attack paper.

— Mozilla

This patch defeats Bleichenbacher by not trying to hide the size of the decrypted text, but to hide if the text succeeded for failed. This is done by generating a fake returned text that's based on the key and the cipher text, so the fake data is always the same for the same key and cipher text. Both the length and the plain text are generated with a prf.

References: https://hg.mozilla.org/projects/nss/rev/fc05574c739947d615ab0b2b2b564f01c922eccd

— Red Hat