Lucene search

K
cveRedhatCVE-2014-0076
HistoryMar 25, 2014 - 1:25 p.m.

CVE-2014-0076

2014-03-2513:25:21
CWE-310
redhat
web.nvd.nist.gov
112
cve-2014-0076
openssl
montgomery ladder
ecdsa
nonces
flush+reload
cache side-channel
security vulnerability

CVSS2

1.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:M/Au:N/C:P/I:N/A:N

AI Score

5.6

Confidence

Low

EPSS

0.001

Percentile

17.0%

The Montgomery ladder implementation in OpenSSL through 1.0.0l does not ensure that certain swap operations have a constant-time behavior, which makes it easier for local users to obtain ECDSA nonces via a FLUSH+RELOAD cache side-channel attack.

Affected configurations

Nvd
Node
opensslopensslRange1.0.0l
OR
opensslopensslMatch0.9.1c
OR
opensslopensslMatch0.9.2b
OR
opensslopensslMatch0.9.3
OR
opensslopensslMatch0.9.3a
OR
opensslopensslMatch0.9.4
OR
opensslopensslMatch0.9.5
OR
opensslopensslMatch0.9.5beta1
OR
opensslopensslMatch0.9.5beta2
OR
opensslopensslMatch0.9.5a
OR
opensslopensslMatch0.9.5abeta1
OR
opensslopensslMatch0.9.5abeta2
OR
opensslopensslMatch0.9.6
OR
opensslopensslMatch0.9.6beta1
OR
opensslopensslMatch0.9.6beta2
OR
opensslopensslMatch0.9.6beta3
OR
opensslopensslMatch0.9.6a
OR
opensslopensslMatch0.9.6abeta1
OR
opensslopensslMatch0.9.6abeta2
OR
opensslopensslMatch0.9.6abeta3
OR
opensslopensslMatch0.9.6b
OR
opensslopensslMatch0.9.6c
OR
opensslopensslMatch0.9.6d
OR
opensslopensslMatch0.9.6e
OR
opensslopensslMatch0.9.6f
OR
opensslopensslMatch0.9.6g
OR
opensslopensslMatch0.9.6h
OR
opensslopensslMatch0.9.6i
OR
opensslopensslMatch0.9.6j
OR
opensslopensslMatch0.9.6k
OR
opensslopensslMatch0.9.6l
OR
opensslopensslMatch0.9.6m
OR
opensslopensslMatch0.9.7
OR
opensslopensslMatch0.9.7beta1
OR
opensslopensslMatch0.9.7beta2
OR
opensslopensslMatch0.9.7beta3
OR
opensslopensslMatch0.9.7beta4
OR
opensslopensslMatch0.9.7beta5
OR
opensslopensslMatch0.9.7beta6
OR
opensslopensslMatch0.9.7a
OR
opensslopensslMatch0.9.7b
OR
opensslopensslMatch0.9.7c
OR
opensslopensslMatch0.9.7d
OR
opensslopensslMatch0.9.7e
OR
opensslopensslMatch0.9.7f
OR
opensslopensslMatch0.9.7g
OR
opensslopensslMatch0.9.7h
OR
opensslopensslMatch0.9.7i
OR
opensslopensslMatch0.9.7j
OR
opensslopensslMatch0.9.7k
OR
opensslopensslMatch0.9.7l
OR
opensslopensslMatch0.9.7m
OR
opensslopensslMatch0.9.8
OR
opensslopensslMatch0.9.8a
OR
opensslopensslMatch0.9.8b
OR
opensslopensslMatch0.9.8c
OR
opensslopensslMatch0.9.8d
OR
opensslopensslMatch0.9.8e
OR
opensslopensslMatch0.9.8f
OR
opensslopensslMatch0.9.8g
OR
opensslopensslMatch0.9.8h
OR
opensslopensslMatch0.9.8i
OR
opensslopensslMatch0.9.8j
OR
opensslopensslMatch0.9.8k
OR
opensslopensslMatch0.9.8l
OR
opensslopensslMatch0.9.8m
OR
opensslopensslMatch0.9.8mbeta1
OR
opensslopensslMatch0.9.8n
OR
opensslopensslMatch0.9.8o
OR
opensslopensslMatch0.9.8p
OR
opensslopensslMatch0.9.8q
OR
opensslopensslMatch0.9.8r
OR
opensslopensslMatch0.9.8s
OR
opensslopensslMatch0.9.8t
OR
opensslopensslMatch0.9.8u
OR
opensslopensslMatch0.9.8v
OR
opensslopensslMatch0.9.8w
OR
opensslopensslMatch0.9.8x
OR
opensslopensslMatch0.9.8y
OR
opensslopensslMatch1.0.0
OR
opensslopensslMatch1.0.0beta1
OR
opensslopensslMatch1.0.0beta2
OR
opensslopensslMatch1.0.0beta3
OR
opensslopensslMatch1.0.0beta4
OR
opensslopensslMatch1.0.0beta5
OR
opensslopensslMatch1.0.0a
OR
opensslopensslMatch1.0.0b
OR
opensslopensslMatch1.0.0c
OR
opensslopensslMatch1.0.0d
OR
opensslopensslMatch1.0.0e
OR
opensslopensslMatch1.0.0f
OR
opensslopensslMatch1.0.0g
OR
opensslopensslMatch1.0.0h
OR
opensslopensslMatch1.0.0i
OR
opensslopensslMatch1.0.0j
OR
opensslopensslMatch1.0.0k
VendorProductVersionCPE
opensslopenssl*cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
opensslopenssl0.9.1ccpe:2.3:a:openssl:openssl:0.9.1c:*:*:*:*:*:*:*
opensslopenssl0.9.2bcpe:2.3:a:openssl:openssl:0.9.2b:*:*:*:*:*:*:*
opensslopenssl0.9.3cpe:2.3:a:openssl:openssl:0.9.3:*:*:*:*:*:*:*
opensslopenssl0.9.3acpe:2.3:a:openssl:openssl:0.9.3a:*:*:*:*:*:*:*
opensslopenssl0.9.4cpe:2.3:a:openssl:openssl:0.9.4:*:*:*:*:*:*:*
opensslopenssl0.9.5cpe:2.3:a:openssl:openssl:0.9.5:*:*:*:*:*:*:*
opensslopenssl0.9.5cpe:2.3:a:openssl:openssl:0.9.5:beta1:*:*:*:*:*:*
opensslopenssl0.9.5cpe:2.3:a:openssl:openssl:0.9.5:beta2:*:*:*:*:*:*
opensslopenssl0.9.5acpe:2.3:a:openssl:openssl:0.9.5a:*:*:*:*:*:*:*
Rows per page:
1-10 of 961

References

CVSS2

1.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:M/Au:N/C:P/I:N/A:N

AI Score

5.6

Confidence

Low

EPSS

0.001

Percentile

17.0%