#VU4133 Information disclosure in OpenSSL - CVE-2016-7056
Published: January 10, 2017 / Updated: July 5, 2022
Vulnerability identifier: #VU4133
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2016-7056
CWE-ID: CWE-310
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
OpenSSL
OpenSSL
Software vendor:
OpenSSL Software Foundation
OpenSSL Software Foundation
Description
The vulnerability allows a local user obtain potentially sensitive information.
The vulnerability exists due the OpenSSL does not properly set the BN_FLG_CONSTTIME for nonces when signing with the P-256 elliptic curve in ecdsa_sign_setup() function in crypto/ec/ecdsa_ossl.c. A local attacker can conduct a cache-timing attack and recover ECDSA P-256 private keys
Successful exploitation of this vulnerability may allow an attacker to obtain potentially sensitive information.
The vulnerability is discovered in OpenSSL 1.0.1u. Other versions may also be affected.
The vulnerability exists due the OpenSSL does not properly set the BN_FLG_CONSTTIME for nonces when signing with the P-256 elliptic curve in ecdsa_sign_setup() function in crypto/ec/ecdsa_ossl.c. A local attacker can conduct a cache-timing attack and recover ECDSA P-256 private keys
Successful exploitation of this vulnerability may allow an attacker to obtain potentially sensitive information.
The vulnerability is discovered in OpenSSL 1.0.1u. Other versions may also be affected.
Remediation
Install update from vendor's website.