GnuPG up to 1.4.15 Computer Processor Acoustic Side-Channel Attack credentials management

CVSS Meta Temp Score CVSS is a standardized scoring system to determine possibilities of attacks. The Temp Score considers temporal factors like disclosure, exploit and countermeasures. The unique Meta Score calculates the average score of different sources to provide a normalized scoring system.	Current Exploit Price (≈) Our analysts are monitoring exploit markets and are in contact with vulnerability brokers. The range indicates the observed or calculated exploit price to be seen on exploit markets. A good indicator to understand the monetary effort required for and the popularity of an attack.	CTI Interest Score Our Cyber Threat Intelligence team is monitoring different web sites, mailing lists, exploit markets and social media networks. The CTI Interest Score identifies the interest of attackers and the security community for this specific vulnerability in real-time. A high score indicates an elevated risk to be targeted for this vulnerability.
4.6	$0-$5k	0.00

Summaryinfo

A vulnerability marked as problematic has been reported in GnuPG. This affects an unknown function of the component Computer Processor. Performing a manipulation results in credentials management (Acoustic Side-Channel Attack). This vulnerability is reported as CVE-2013-4576. Moreover, an exploit is present. This vulnerability is considered historic because of its background and reception. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in GnuPG. This affects an unknown code of the component Computer Processor. The manipulation with an unknown input leads to a credentials management vulnerability (Acoustic Side-Channel Attack). CWE is classifying the issue as CWE-255. This is going to have an impact on confidentiality. The summary by CVE is:

GnuPG 1.x before 1.4.16 generates RSA keys using sequences of introductions with certain patterns that introduce a side channel, which allows physically proximate attackers to extract RSA keys via a chosen-ciphertext attack and acoustic cryptanalysis during decryption. NOTE: applications are not typically expected to protect themselves from acoustic side-channel attacks, since this is arguably the responsibility of the physical device. Accordingly, issues of this type would not normally receive a CVE identifier. However, for this issue, the developer has specified a security policy in which GnuPG should offer side-channel resistance, and developer-specified security-policy violations are within the scope of CVE.

The weakness was disclosed 12/18/2013 by Daniel Genkin, Adi Shamir and Eran Tromer as RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis as not defined article (Website). It is possible to read the advisory at cs.tau.ac.il. The vendor was not involved in the public release. This vulnerability is uniquely identified as CVE-2013-4576 since 06/12/2013. Attacking locally is a requirement. No form of authentication is needed for exploitation. Technical details are unknown but a public exploit is available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/04/2021). The attack technique deployed by this issue is T1552 according to MITRE ATT&CK. Due to its background and reception, this vulnerability has a historic impact. The advisory points out:

Here, we describe a new acoustic cryptanalysis key extraction attack, applicable to GnuPG's current implementation of RSA. The attack can extract full 4096-bit RSA decryption keys from laptop computers (of various models), within an hour, using the sound generated by the computer during the decryption of some chosen ciphertexts. We experimentally demonstrate that such attacks can be carried out, using either a plain mobile phone placed next to the computer, or a more sensitive microphone placed 4 meters away. (…) The acoustic signal of interest is generated by vibration of electronic components (capacitors and coils) in the voltage regulation circuit, as it struggles to supply constant voltage to the CPU despite the large fluctuations in power consumption caused by different patterns of CPU operations. The relevant signal is not caused by mechanical components such as the fan or hard disk, nor by the laptop's internal speaker.

A public exploit has been developed by Daniel Genkin/Adi Shamir/Eran Tromer and been published immediately after the advisory. The exploit is shared for download at tau.ac.il. It is declared as proof-of-concept. We expect the 0-day to have been worth approximately $5k-$25k. The vulnerability scanner Nessus provides a plugin with the ID 71554 (Mandriva Linux Security Advisory : gnupg (MDVSA-2013:295)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Mandriva Local Security Checks. The commercial vulnerability scanner Qualys is able to test this issue with plugin 123450 (Fedora Security Update for gnupg (FEDORA-2015-3253)). The advisory illustrates:

In almost all machines, it is possible to distinguish an idle CPU (x86 "HLT") from a busy CPU. On many machines, it is moreover possible to distinguish different patterns of CPU operations and different programs.

Upgrading to version 1.4.16 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability. The article contains the following remark:

One obvious countermeasure is to use sound dampening equipment, such as "sound-proof" boxes, designed to sufficiently attenuate all relevant frequencies. Conversely, a sufficiently strong wide-band noise source can mask the informative signals, though ergonomic concerns may render this unattractive. Careful circuit design and high-quality electronic components can probably reduce the emanations. Alternatively, the cryptographic software can be changed, and algorithmic techniques employed to render the emanations less useful to the attacker. These techniques ensure that the rough-scale behavior of the algorithm is independent of the inputs it receives; they usually carry some performance penalty, but are often used in any case to thwart other side-channel attacks. This is what we helped implement in GnuPG.

The vulnerability is also documented in the databases at X-Force (89846), Tenable (71554), SecurityFocus (BID 64424†), OSVDB (101170†) and Vulnerability Center (SBV-42764†). Further details are available at extremetech.com. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• GnuPG

Version

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4
• 1.0.5
• 1.0.6
• 1.0.7
• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4
• 1.2.5
• 1.2.6
• 1.2.7
• 1.3.0
• 1.3.1
• 1.3.2
• 1.3.3
• 1.3.4
• 1.3.6
• 1.3.90
• 1.3.91
• 1.3.92
• 1.3.93
• 1.4
• 1.4.0
• 1.4.2
• 1.4.3
• 1.4.4
• 1.4.5
• 1.4.6
• 1.4.8
• 1.4.10
• 1.4.11
• 1.4.12
• 1.4.13
• 1.4.14
• 1.4.15

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

VulDB Vector: 🔍
VulDB Reliability: 🔍

CVSSv3info

VulDB Meta Base Score: 5.1
VulDB Meta Temp Score: 4.6

VulDB Base Score: 5.1
VulDB Temp Score: 4.6
VulDB Vector: 🔍
VulDB Reliability: 🔍

CVSSv2info

AV	AC	Au	C	I	A
💳	💳	💳	💳	💳	💳
💳	💳	💳	💳	💳	💳
💳	💳	💳	💳	💳	💳

Vector	Complexity	Authentication	Confidentiality	Integrity	Availability
Unlock	Unlock	Unlock	Unlock	Unlock	Unlock
Unlock	Unlock	Unlock	Unlock	Unlock	Unlock
Unlock	Unlock	Unlock	Unlock	Unlock	Unlock

VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍

NVD Base Score: 🔍

Exploitinginfo

Name: Acoustic Side-Channel Attack
Class: Credentials management / Acoustic Side-Channel Attack
CWE: CWE-255
CAPEC: 🔍
ATT&CK: 🔍

Physical: Partially
Local: Yes
Remote: No

Availability: 🔍
Access: Public
Status: Proof-of-Concept
Author: Daniel Genkin/Adi Shamir/Eran Tromer
Download: 🔍

EPSS Score: 🔍
EPSS Percentile: 🔍

Price Prediction: 🔍
Current Price Estimation: 🔍

0-Day	Unlock	Unlock	Unlock	Unlock
Today	Unlock	Unlock	Unlock	Unlock

Nessus ID: 71554
Nessus Name: Mandriva Linux Security Advisory : gnupg (MDVSA-2013:295)
Nessus File: 🔍
Nessus Risk: 🔍
Nessus Family: 🔍
Nessus Port: 🔍

OpenVAS ID: 702821
OpenVAS Name: Debian Security Advisory DSA 2821-1 (gnupg - side channel attack
OpenVAS File: 🔍
OpenVAS Family: 🔍

Qualys ID: 🔍
Qualys Name: 🔍

Threat Intelligenceinfo

Interest: 🔍
Active Actors: 🔍
Active APT Groups: 🔍

Countermeasuresinfo

Recommended: Upgrade
Status: 🔍

Reaction Time: 🔍
0-Day Time: 🔍
Exposure Time: 🔍
Exploit Delay Time: 🔍

Upgrade: GnuPG 1.4.16

Timelineinfo

06/12/2013 🔍
12/18/2013 +189 days 🔍
12/18/2013 +0 days 🔍
12/18/2013 +0 days 🔍
12/18/2013 +0 days 🔍
12/20/2013 +2 days 🔍
12/20/2013 +0 days 🔍
12/20/2013 +0 days 🔍
01/01/2014 +12 days 🔍
06/04/2021 +2711 days 🔍

Sourcesinfo

Advisory: RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis
Researcher: Daniel Genkin, Adi Shamir, Eran Tromer
Status: Not defined

CVE: CVE-2013-4576 (🔍)
GCVE (CVE): GCVE-0-2013-4576
GCVE (VulDB): GCVE-100-11547

OVAL: 🔍

X-Force: 89846
SecurityFocus: 64424
OSVDB: 101170
SecurityTracker: 1029513
Vulnerability Center: 42764 - Gnu GnuPG 1.x Before 1.4.15 Local RSA Keys Extraction Vulnerability, Low

scip Labs: https://www.scip.ch/en/?labs.20161013
Misc.: 🔍

Entryinfo

Created: 12/20/2013 10:26
Updated: 06/04/2021 13:47
Changes: 12/20/2013 10:26 (86), 05/18/2017 17:49 (1), 06/04/2021 13:40 (3), 06/04/2021 13:47 (1)
Complete: 🔍
Cache ID: 216::103

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion

Want to stay up to date on a daily basis?

Enable the mail alert feature now!