Observable response discrepancy in openssl-ibmca - #VU75558

Vulnerability identifier: #VU75558

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: N/A

CWE-ID: CWE-204

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to observable discrepancy in the IBMCA engine. A remote attacker can perform a timing-based side channel attack in RSA.

openssl-ibmca
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 12
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Server Applications Module
openSUSE Leap
Ubuntu
openssl-ibmca (Ubuntu package)
openssl-ibmca
openssl-ibmca-debuginfo-32bit
openssl-ibmca-debugsource
openssl-ibmca-32bit
openssl-ibmca-debuginfo

Install updates from vendor's website.

openssl-ibmca - update to 2.4.0
openssl-ibmca (Ubuntu package) - addressed in versions Ubuntu Pro, 1.4.1-0ubuntu1.2, 2.1.0-0ubuntu1.20.04.2, 2.2.3-0ubuntu1.1, 2.3.0-0ubuntu1.1
openssl-ibmca - addressed in versions 2.0.3-4.3.1, 2.4.0-150400.4.8.1
openssl-ibmca-debuginfo-32bit - update to 2.0.3-4.3.1
openssl-ibmca-debugsource - addressed in versions 2.0.3-4.3.1, 2.4.0-150400.4.8.1
openssl-ibmca-32bit - update to 2.0.3-4.3.1
openssl-ibmca-debuginfo - addressed in versions 2.0.3-4.3.1, 2.4.0-150400.4.8.1

• https://www.suse.com/support/update/announcement/2023/suse-su-20232047-1/
• https://bugzilla.suse.com/show_bug.cgi?id=1210057
• https://bugzilla.suse.com/show_bug.cgi?id=1210058
• https://bugzilla.suse.com/show_bug.cgi?id=1210359

• Side channel attack in openssl-ibmca
• SUSE update for openssl-ibmca
• SUSE update for openssl-ibmca
• Ubuntu update for openssl-ibmca