Covert Timing Channel in Mozilla NSS - CVE-2023-4421

Vulnerability identifier: #VU84108

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-4421

CWE-ID: CWE-385

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to NSS code used for checking PKCS#1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks. Both the overall correctness of the padding as well as the length of the encrypted message was leaking through timing side-channel. By sending large number of attacker-selected ciphertexts, the attacker would be able to decrypt a previously intercepted PKCS#1 v1.5 ciphertext (for example, to decrypt a TLS session that used RSA key exchange), or forge a signature using the victim's key.

Mozilla NSS
Amazon Linux AMI
openEuler
Ubuntu
Robotic Process Automation for Cloud Pak
nss-softokn
nss
nss-util-devel
nss-util
nss-softokn-devel
nss-help
nss-devel
nss-debugsource
nss-debuginfo
libnss3 (Ubuntu package)

Install updates from vendor's website.

Mozilla NSS - update to 3.61
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.12, 23.0.12
nss-softokn - update to 3.53.1-6.48
nss - update to 3.54.0-13
nss-util-devel - update to 3.54.0-13
nss-util - update to 3.54.0-13
nss-softokn-devel - update to 3.54.0-13
nss-softokn - update to 3.54.0-13
nss-help - update to 3.54.0-13
nss-devel - update to 3.54.0-13
nss-debugsource - update to 3.54.0-13
nss-debuginfo - update to 3.54.0-13
libnss3 (Ubuntu package) - addressed in versions 2:3.98-0ubuntu0.20.04.1, 2:3.98-0ubuntu0.20.04.2, 2:3.98-0ubuntu0.22.04.1, 2:3.98-0ubuntu0.22.04.2, 2:3.98-0ubuntu0.23.10.1

• https://www.mozilla.org/en-US/security/advisories/mfsa2023-53/

• Timing side-channel attack in Mozilla NSS
• Amazon Linux AMI update for nss-softokn
• Covert timing channel in IBM Robotic Process Automation for Cloud Pak
• Ubuntu update for nss
• Ubuntu update for nss
• openEuler 20.03 LTS SP4 update for nss