Covert timing channel in Mozilla NSS - CVE-2023-5388

Vulnerability identifier: #VU85267

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2023-5388

CWE-ID: CWE-385

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
Mozilla NSS
Oracle Solaris
Amazon Linux AMI
Gentoo Linux
Oracle Linux
Debian Linux
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Software Development Kit 12
SUSE Linux Enterprise Workstation Extension 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
Red Hat Enterprise Linux for Power, little endian
Anolis OS
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Fedora
CentOS
SUSE Enterprise Storage
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Slackware Linux
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
SUSE Linux Enterprise Desktop 15 SP4 LTSS
Basesystem Module
SUSE Package Hub 15
openSUSE Leap
Ubuntu
openEuler
Red Hat OpenShift Serverless
Migration Toolkit for Runtimes
Cryostat
Oracle Communications Network Analytics Data Director
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications Cloud Native Core Network Repository Function
App Connect Enterprise Certified Container
IBM MQ
IBM Power Hardware Management Console (HMC)
IBM Observability with Instana
Red Hat OpenShift Container Platform
JD Edwards EnterpriseOne Tools
Communications Unified Assurance
Oracle Communications Instant Messaging Server
RecoverPoint for Virtual Machines
IBM Qradar SIEM
Juniper Secure Analytics (JSA)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
seamonkey
nss-softokn
nss (Red Hat package)
nss
nss-util
nss-util-devel
nss-tools
nss-sysinit
nss-softokn-freebl-devel
nss-softokn-freebl
nss-softokn-devel
nss-devel
mozilla-nss-tools
mozilla-nss-32bit
mozilla-nss-tools-debuginfo
libfreebl3-debuginfo
mozilla-nss
mozilla-nss-sysinit-debuginfo
libfreebl3
libsoftokn3
libsoftokn3-debuginfo
mozilla-nss-debuginfo-32bit
mozilla-nss-sysinit-debuginfo-32bit
mozilla-nss-certs-debuginfo-32bit
libsoftokn3-debuginfo-32bit
libfreebl3-debuginfo-32bit
mozilla-nss-certs-32bit
libsoftokn3-32bit
mozilla-nss-sysinit-32bit
libfreebl3-32bit
mozilla-nss-certs-debuginfo
mozilla-nss-certs
mozilla-nss-debuginfo
mozilla-nss-debugsource
mozilla-nss-devel
mozilla-nss-sysinit
mozilla-nss-sysinit-32bit-debuginfo
libsoftokn3-32bit-debuginfo
mozilla-nss-32bit-debuginfo
libfreebl3-32bit-debuginfo
mozilla-nss-certs-32bit-debuginfo
mozilla-nss-sysinit-64bit
mozilla-nss-sysinit-64bit-debuginfo
libsoftokn3-64bit
mozilla-nss-certs-64bit-debuginfo
libsoftokn3-64bit-debuginfo
mozilla-nss-certs-64bit
libfreebl3-64bit
libfreebl3-64bit-debuginfo
mozilla-nss-64bit-debuginfo
mozilla-nss-64bit
dev-libs/nss
libnss3 (Ubuntu package)
thunderbird (Ubuntu package)
mozilla-thunderbird
mozilla-firefox
firefox-esr (Debian package)
thunderbird (Red Hat package)
thunderbird
thunderbird (Debian package)
MozillaThunderbird-debuginfo
MozillaThunderbird
MozillaThunderbird-debugsource
MozillaThunderbird-translations-common
MozillaThunderbird-translations-other
firefox (Red Hat package)
firefox
firefox (Ubuntu package)
firefox-flatpak
firefox-debuginfo
firefox-debugsource
Oracle Communications Policy Management
PowerStore X
PowerStore T
IBM Cloud Pak for Watson AIOps
Storage Resource Manager
EMC Cloud Tiering Appliance
Robotic Process Automation for Cloud Pak
Oracle Communications Cloud Native Core Policy
Mozilla Firefox
Firefox ESR
Firefox for Android
Mozilla Thunderbird
Dell EMC Storage Monitoring and Reporting (SMR)
Dell EMC VxRail Appliance

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to insufficient fix for #VU84108 (CVE-2023-4421). A remote attacker can perform Marvin attack and gain access to sensitive information.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

• https://people.redhat.com/~hkario/marvin/
• https://bugzilla.redhat.com/show_bug.cgi?id=2243644