Timing-Based Attack on IBM CCA Could Lead to Sensitive Information Disclosure

CVE-2023-33855

Summary

IBM Common Cryptographic Architecture versions 7.0.0 through 7.5.36 exhibit a vulnerability that may allow remote attackers to execute timing-based attacks, leading to potential exposure of sensitive information. The issue arises from non-constant-time behavior during RSA operations, which could be exploited under specific conditions. This vulnerability emphasizes the need for heightened security measures and constant-time implementation practices to mitigate exposure to such timing attacks.

References