Bug 1386584 (CVE-2016-7440) - CVE-2016-7440 yaSSL: AES key leak via cache-bank timing side channel attack
Summary: CVE-2016-7440 yaSSL: AES key leak via cache-bank timing side channel attack
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2016-7440
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20161019,repor...
Depends On:
Blocks: 1386598
TreeView+ depends on / blocked
 
Reported: 2016-10-19 09:21 UTC by Adam Mariš
Modified: 2019-06-08 21:31 UTC (History)
29 users (show)

Fixed In Version: mysql 5.5.53, mysql 5.6.34, mysql 5.7.16, yaSSL 2.4.2, wolfSSL 3.9.10, mariadb 5.5.53, mariadb 10.1.19, mariadb 10.0.28
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-10-19 11:05:38 UTC


Attachments (Terms of Use)

Description Adam Mariš 2016-10-19 09:21:16 UTC
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Encryption). Supported versions that are affected are 5.5.52 and earlier, 5.6.33 and earlier and  5.7.15 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. 

External References:

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881724.html#AppendixMSQL

Comment 1 Adam Mariš 2016-10-19 09:54:05 UTC
Created mariadb tracking bugs for this issue:

Affects: fedora-all [bug 1386608]

Comment 2 Adam Mariš 2016-10-19 09:54:21 UTC
Created community-mysql tracking bugs for this issue:

Affects: fedora-all [bug 1386607]

Comment 3 Adam Mariš 2016-10-19 09:54:32 UTC
Created mariadb-galera tracking bugs for this issue:

Affects: fedora-all [bug 1386609]

Comment 4 Tomas Hoger 2016-10-19 11:05:38 UTC
This is not a MySQL flaw, but a flaw in embedded yaSSL library:

https://wolfssl.com/wolfSSL/Blog/Entries/2016/9/26_wolfSSL_3.9.10_Vulnerability_Fixes.html
https://www.wolfssl.com/wolfSSL/Blog/Entries/2016/9/26_wolfSSL_3.9.10_Now_Available.html

It is mentioned in the respective MySQL release notes as:

  yaSSL was upgraded to version 2.4.2. This upgrade corrects issues with:
  Potential AES side channel leaks; ...

http://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-16.html
http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-34.html
http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-53.html

Further details form the yaSSL README:

https://github.com/mysql/mysql-server/commit/5c6169fb309981b564a17bee31b367a18866d674

yaSSL Release notes, version 2.4.2 (9/22/2016)
    This release of yaSSL fixes a medium security vulnerability. A fix for
    potential AES side channel leaks is included that a local user monitoring
    the same CPU core cache could exploit.  VM users, hyper-threading users,
    and users where potential attackers have access to the CPU cache will need
    to update if they utilize AES.

MySQL and MariaDB packages included in Red Hat products are built against system OpenSSL packages.  They are not using embedded yaSSL, and are therefore not affected by this issue.


Note You need to log in before you can comment on or make changes to this bug.