Security Bulletin: Multiple vulnerabilities in IBM's Common Cryptographic Architecture (CCA). CVE-2023-33855, CVE-2023-47150

Summary

IBM Common Cryptographic Architecture (CCA) is used to interface with the IBM Hardware Security Module (HSM). CCA could allow a remote user to cause a denial of service attack (CVE-2023-47150) or to obtain sensitive information (CVE-2023-33855) as described in the vulnerability details section. IBM has provided fixes as described in the remediation/fixes section.

Vulnerability Details

CVEID:CVE-2023-47150
**DESCRIPTION:**IBM Common Cryptographic Architecture (CCA) could allow a remote user to cause a denial of service due to incorrect data handling for certain types of AES operations.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/270602 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2023-33855
**DESCRIPTION:**Under certain conditions, RSA operations performed by IBM Common Cryptographic Architecture (CCA) may exhibit non-constant-time behavior. This could allow a remote attacker to obtain sensitive information using a timing-based attack.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/257676 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

CCA 7.x MTM for 4769

|

IBM AIX, IBM i, IBM PowerLinux, Linux (Intel x86 platforms)

| 7.0.0 - 7.5.36

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by upgrading:

Platform-specific upgrade information:

IBM AIX

For CCA 7.x for 4769, please download version 7.5.37 or later from the CCA Software Download Page.

IBM i

PTFs are available for IBM i releases 7.5, 7.4, and 7.3. The CY3 PTF update CCA 7.x MTM for 4769, bringing the firmware level to 7.5.37 or later. The SS1 PTF updates the CCA version to 7.5 or later.

The PTF numbers containing the fix for this vulnerability are in the following table:

IBM i release

|

5733-CY3 IBM Cryptographic Device Manager for i PTF Number

|

5770-SS1 option 35 IBM CCA Cryptographic Service Provider for i PTF Number

—|—|—

7.5

|

SI85409

|

SI85370

7.4

|

SI85411

|

SI85368

7.3

|

SI85412

|

SI85371

IBM PowerLinux

For CCA 7.x for 4769, please download version 7.5.37 or later from the CCA Software Download Page.

**Linux on Intel x86 **

For CCA 7.x for 4769, please download version 7.5.37 or later from the CCA Software Download Page.

Workarounds and Mitigations

For CVE-2023-33855: There are no workarounds.

For CVE-2023-47150: Customers who do not use CSNBSAD or CSNBSAE in their workflows can mitigate the issue by ensuring that the corresponding access-control points (ACPs) are disabled.