Information disclosure in OpenSSL

1) Side-channel attack

EUVDB-ID: #VU15723

Risk: Low

CVSSv3.1: 4.4 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:U/RC:C]

CVE-ID: CVE-2018-5407

CWE-ID: CWE-208 - Information Exposure Through Timing Discrepancy

Exploit availability: Yes

Description

The vulnerability allows a physical attacker to obtain potentially sensitive information.

The vulnerability exists due to due to execution of engine sharing on SMT (e.g.Hyper-Threading) architectures when improper handling of information by the processor. A physical attacker can construct a timing side channel to hijack information from processes that are running in the same core.

Note: the vulnerability has been dubbed as PortSmash microarchitecture bug.

Mitigation

Update to version 1.1.0i.

Vulnerable software versions

OpenSSL: 1.1.0 - 1.1.0h

External links

http://www.openssl.org/news/secadv/20181112.txt

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.