IBM Common Cryptographic Architecture up to 7.5.36 covert timing channel

Summaryinfo

A vulnerability classified as problematic was found in IBM Common Cryptographic Architecture up to 7.5.36. This impacts an unknown function. Executing a manipulation can lead to covert timing channel. This vulnerability is tracked as CVE-2023-33855. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in IBM Common Cryptographic Architecture up to 7.5.36. It has been declared as problematic. This vulnerability affects an unknown function. The manipulation with an unknown input leads to a covert timing channel vulnerability. The CWE definition for the vulnerability is CWE-385. Covert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information. As an impact it is known to affect confidentiality. CVE summarizes:

Under certain conditions, RSA operations performed by IBM Common Cryptographic Architecture (CCA) 7.0.0 through 7.5.36 may exhibit non-constant-time behavior. This could allow a remote attacker to obtain sensitive information using a timing-based attack. IBM X-Force ID: 257676.

The advisory is shared for download at ibm.com. This vulnerability was named CVE-2023-33855 since 05/23/2023. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at X-Force (257676). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• IBM

Name

• Common Cryptographic Architecture

Version

• 7.5.0
• 7.5.1
• 7.5.2
• 7.5.3
• 7.5.4
• 7.5.5
• 7.5.6
• 7.5.7
• 7.5.8
• 7.5.9
• 7.5.10
• 7.5.11
• 7.5.12
• 7.5.13
• 7.5.14
• 7.5.15
• 7.5.16
• 7.5.17
• 7.5.18
• 7.5.19
• 7.5.20
• 7.5.21
• 7.5.22
• 7.5.23
• 7.5.24
• 7.5.25
• 7.5.26
• 7.5.27
• 7.5.28
• 7.5.29
• 7.5.30
• 7.5.31
• 7.5.32
• 7.5.33
• 7.5.34
• 7.5.35
• 7.5.36

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion