Bug 1331426 (CVE-2016-2107) - CVE-2016-2107 openssl: Padding oracle in AES-NI CBC MAC check
Summary: CVE-2016-2107 openssl: Padding oracle in AES-NI CBC MAC check
Status: CLOSED ERRATA
Alias: CVE-2016-2107
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20160503,repor...
Keywords: Security
Depends On: 1331569 1331570 1331865 1331866 1332407 1332588 1332589 1332590 1332591 1366994
Blocks: 1330106 1395463
TreeView+ depends on / blocked
 
Reported: 2016-04-28 13:46 UTC by Tomas Hoger
Modified: 2019-06-08 21:09 UTC (History)
49 users (show)

(edit)
It was discovered that OpenSSL leaked timing information when decrypting TLS/SSL and DTLS protocol encrypted records when the connection used the AES CBC cipher suite and the server supported AES-NI. A remote attacker could possibly use this flaw to retrieve plain text from encrypted packets by using a TLS/SSL or DTLS server as a padding oracle.
Clone Of:
(edit)
Last Closed: 2017-02-22 12:29:07 UTC


Attachments (Terms of Use)
OpenSSL upstream fix (1.99 KB, patch)
2016-04-28 13:58 UTC, Tomas Hoger
no flags Details | Diff


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:0722 normal SHIPPED_LIVE Important: openssl security update 2016-05-09 13:28:24 UTC
Red Hat Knowledge Base (Solution) 2298211 None None None 2016-05-05 23:21 UTC
Red Hat Product Errata RHSA-2016:0996 normal SHIPPED_LIVE Important: openssl security update 2016-05-10 08:18:56 UTC
Red Hat Product Errata RHSA-2016:2073 normal SHIPPED_LIVE Important: openssl security update 2016-10-18 11:08:06 UTC
Red Hat Product Errata RHSA-2016:2957 normal SHIPPED_LIVE Important: Red Hat JBoss Core Services Apache HTTP 2.4.23 Release 2016-12-16 03:11:19 UTC

Description Tomas Hoger 2016-04-28 13:46:53 UTC
Quoting form the draft of OpenSSL upstream advisory:

Padding oracle in AES-NI CBC MAC check (CVE-2016-2107)
======================================================

Severity: High

A MITM attacker can use a padding oracle attack to decrypt traffic
when the connection uses an AES CBC cipher and the server support
AES-NI.

This issue was introduced as part of the fix for Lucky 13 padding
attack (CVE-2013-0169). The padding check was rewritten to be in
constant time by making sure that always the same bytes are read and
compared against either the MAC or padding bytes. But it no longer
checked that there was enough data to have both the MAC and padding
bytes.

OpenSSL 1.0.2 users should upgrade to 1.0.2h
OpenSSL 1.0.1 users should upgrade to 1.0.1t

This issue was reported to OpenSSL on 13th of April 2016 by Juraj
Somorovsky. The fix was developed by Kurt Roeckx of the OpenSSL
development team.

Comment 1 Tomas Hoger 2016-04-28 13:47:04 UTC
Acknowledgments:

Name: the OpenSSL project
Upstream: Juraj Somorovsky

Comment 2 Tomas Hoger 2016-04-28 13:58 UTC
Created attachment 1151920 [details]
OpenSSL upstream fix

Comment 6 Martin Prpič 2016-05-03 14:19:21 UTC
External References:

https://openssl.org/news/secadv/20160503.txt

Comment 7 Martin Prpič 2016-05-03 14:28:18 UTC
Created openssl101e tracking bugs for this issue:

Affects: epel-5 [bug 1332590]

Comment 8 Martin Prpič 2016-05-03 14:28:24 UTC
Created openssl tracking bugs for this issue:

Affects: fedora-all [bug 1332588]

Comment 9 Martin Prpič 2016-05-03 14:28:29 UTC
Created mingw-openssl tracking bugs for this issue:

Affects: fedora-all [bug 1332589]
Affects: epel-7 [bug 1332591]

Comment 11 Fedora Update System 2016-05-04 18:51:36 UTC
openssl-1.0.2h-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 12 Tomas Hoger 2016-05-05 11:40:50 UTC
Detailed write-up from the original reporter:

http://web-in-security.blogspot.com/2016/05/curious-padding-oracle-in-openssl-cve.html

Detailed independent analysis of the issue:

https://blog.cloudflare.com/yet-another-padding-oracle-in-openssl-cbc-ciphersuites/

Comment 13 Fedora Update System 2016-05-07 11:38:44 UTC
openssl-1.0.2h-1.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.

Comment 14 errata-xmlrpc 2016-05-09 09:29:26 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2016:0722 https://rhn.redhat.com/errata/RHSA-2016-0722.html

Comment 15 errata-xmlrpc 2016-05-10 04:21:00 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2016:0996 https://rhn.redhat.com/errata/RHSA-2016-0996.html

Comment 18 Fedora Update System 2016-05-10 17:52:10 UTC
openssl-1.0.1k-15.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.

Comment 19 Fedora Update System 2016-05-27 23:16:46 UTC
openssl101e-1.0.1e-8.el5 has been pushed to the Fedora EPEL 5 stable repository. If problems still persist, please make note of it in this bug report.

Comment 20 Akshay Jain 2016-07-29 12:11:03 UTC
Hello Team,

Customer is requesting for backporting of this fix of openssl into 6.7 (EUS).
Please check

Comment 22 errata-xmlrpc 2016-10-18 07:09:25 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6.7 Extended Update Support

Via RHSA-2016:2073 https://rhn.redhat.com/errata/RHSA-2016-2073.html

Comment 23 Andrew Sanders 2016-11-10 17:41:41 UTC
(In reply to errata-xmlrpc from comment #22)
> This issue has been addressed in the following products:
> 
>   Red Hat Enterprise Linux 6.7 Extended Update Support
> 
> Via RHSA-2016:2073 https://rhn.redhat.com/errata/RHSA-2016-2073.html

This makes this bugzilla appear to have been addressed, but the status is still "NEW".  I've got a customer that confirmed this patch is in their RHEL6.7 EUS patches that they received via the normal RHN stream.  Should this bug have been closed by now?

Comment 25 errata-xmlrpc 2016-12-15 22:17:33 UTC
This issue has been addressed in the following products:



Via RHSA-2016:2957 https://rhn.redhat.com/errata/RHSA-2016-2957.html


Note You need to log in before you can comment on or make changes to this bug.