Bug 1568253 (CVE-2018-0737)

Summary: CVE-2018-0737 openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys
Product: [Other] Security Response Reporter: Sam Fowler <sfowler>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: bmaxwell, cdewolf, chazlett, csutherl, darran.lofthouse, dimitris, dosoudil, erik-fedora, fgavrilo, gzaronik, jawilson, jclere, jondruse, jorton, ktietz, lersek, lgao, marcandre.lureau, mbabacek, mturk, myarboro, pgier, pjurak, ppalaga, psakar, pslavice, rjones, rnetuka, rstancel, rsvoboda, slawomir, tmraz, twalsh, vtunka, weli, yozone, ysoni
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=low,public=20180416,reported=20180417,source=oss-security,cvss3=3.3/CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N,cwe=CWE-385,rhel-5/openssl=wontfix,rhel-5/openssl097a=wontfix,rhel-6/openssl=affected,rhel-6/openssl098e=wontfix,rhel-7/openssl=affected,rhel-7/openssl098e=wontfix,jbcs-1/openssl=affected,jbews-2/openssl=wontfix,jws-3/openssl=affected,eap-6/openssl=wontfix,eap-5/openssl=wontfix,fedora-all/openssl=affected,fedora-all/mingw-openssl=affected,epel-7/mingw-openssl=affected,rhel-7/OVMF=new,rhel-8/openssl=notaffected
Fixed In Version: openssl 1.1.0i, openssl 1.0.2p Doc Type: If docs needed, set a value
Doc Text:
OpenSSL RSA key generation was found to be vulnerable to cache side-channel attacks. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover parts of the private key.
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-10 10:20:03 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 1568254, 1568257, 1568255, 1568256, 1568681, 1568682    
Bug Blocks: 1568258    

Description Sam Fowler 2018-04-17 04:08:30 UTC
OpenSSL before versions 1.0.2p and 1.1.0i are vulnerable to RSA key generation cache timing side channel attacks. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key.


External References:

https://www.openssl.org/news/secadv/20180416.txt
http://www.openwall.com/lists/oss-security/2018/04/16/3


Upstream Patches:

https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=349a41da1ad88ad87825414752a8ff5fdd6a6c3f
https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6939eab03a6e23d2bd2c3f5e34fe1d48e542e787

Comment 1 Sam Fowler 2018-04-17 04:09:16 UTC
Created openssl tracking bugs for this issue:

Affects: fedora-all [bug 1568256]


Created mingw-openssl tracking bugs for this issue:

Affects: fedora-all [bug 1568257]
Affects: epel-7 [bug 1568254]

Comment 3 Huzaifa S. Sidhpurwala 2018-04-17 04:51:11 UTC
Analysis:

This attack needs the attacker to be present on the same physical machine, where the key is being generated. Also the attack has to be mounted at the exact time, when the RSA private key is being generated, to be useful. Enterprise setups where HSM modules are used to generate and store RSA private keys are not affected by this flaw.

Comment 8 errata-xmlrpc 2018-10-30 07:51:29 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:3221 https://access.redhat.com/errata/RHSA-2018:3221