Red Hat Bugzilla – Bug 1386584
CVE-2016-7440 yaSSL: AES key leak via cache-bank timing side channel attack
Last modified: 2018-04-06 08:18:20 EDT
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Encryption). Supported versions that are affected are 5.5.52 and earlier, 5.6.33 and earlier and 5.7.15 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. External References: http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881724.html#AppendixMSQL
Created mariadb tracking bugs for this issue: Affects: fedora-all [bug 1386608]
Created community-mysql tracking bugs for this issue: Affects: fedora-all [bug 1386607]
Created mariadb-galera tracking bugs for this issue: Affects: fedora-all [bug 1386609]
This is not a MySQL flaw, but a flaw in embedded yaSSL library: https://wolfssl.com/wolfSSL/Blog/Entries/2016/9/26_wolfSSL_3.9.10_Vulnerability_Fixes.html https://www.wolfssl.com/wolfSSL/Blog/Entries/2016/9/26_wolfSSL_3.9.10_Now_Available.html It is mentioned in the respective MySQL release notes as: yaSSL was upgraded to version 2.4.2. This upgrade corrects issues with: Potential AES side channel leaks; ... http://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-16.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-34.html http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-53.html Further details form the yaSSL README: https://github.com/mysql/mysql-server/commit/5c6169fb309981b564a17bee31b367a18866d674 yaSSL Release notes, version 2.4.2 (9/22/2016) This release of yaSSL fixes a medium security vulnerability. A fix for potential AES side channel leaks is included that a local user monitoring the same CPU core cache could exploit. VM users, hyper-threading users, and users where potential attackers have access to the CPU cache will need to update if they utilize AES. MySQL and MariaDB packages included in Red Hat products are built against system OpenSSL packages. They are not using embedded yaSSL, and are therefore not affected by this issue.