Bug 2270358 (CVE-2024-2408)

Summary: CVE-2024-2408 php: potential exposure to Marvin attack via unsafe implementation of RSA decryption API
Product: [Other] Security Response Reporter: Robb Gatica <rgatica>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: hkario, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: php 8.2.12 Doc Type: If docs needed, set a value
Doc Text:
The RSA decryption implementation using PKCS#1 v1.5 padding in OpenSSL is vulnerable to a timing side-channel attack known as the Marvin Attack. This vulnerability arises because the execution time of the openssl_private_decrypt() function in PHP with OpenSSL varies based on whether a valid message is returned. This flaw allows an attacker to use these timing differences to decrypt captured ciphertexts or forge signatures, compromising the security of the encrypted data. The vulnerability has been demonstrated through statistical analysis of execution times, confirming the presence of a side channel that can be leveraged in a Bleichenbacher-style attack.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2291133    
Bug Blocks: 2270357    

Description Robb Gatica 2024-03-19 22:21:31 UTC 
As with other users of OpenSSL vulnerable to the Marvin Attack, the issue is caused by improper use of the RSA decryption APIs provided
by OpenSSL. Upstream doesn't plan to introduce any code changes, but instead document that the API is unsafe to use unless it's used with OpenSSL that implements implicit rejection (we have already shipped those fixes in RHEL 8, 9, and in Fedora).

References:
https://people.redhat.com/~hkario/marvin/
https://github.com/openssl/openssl/pull/13817
https://www.php.net/manual/en/function.openssl-private-decrypt.php
Comment 2 Alicja Kario 2024-06-07 09:24:57 UTC 
This issue is now public: https://github.com/php/php-src/security/advisories/GHSA-hh26-4ppw-5864
Comment 3 Sandipan Roy 2024-06-10 08:02:43 UTC 
Created php tracking bugs for this issue:

Affects: fedora-all [bug 2291133]