CVE-2021-32921: 
NixOS vulnerability analysis and mitigation

A timing-dependent string comparison vulnerability (CVE-2021-32921) was discovered in Prosody before version 0.11.9. The issue stems from the software not using a constant-time algorithm for comparing certain secret strings when running under Lua 5.2 or later. This vulnerability was discovered in May 2021 and affects all versions of Prosody prior to 0.11.9 (Prosody Blog, OSS Security).

The vulnerability occurs because Prosody does not implement constant-time string comparison for sensitive data. While Lua 5.1 utilized a technique called 'string interning' that protected string comparisons from timing attacks, in Lua 5.2 and later versions, strings over 40 bytes in length are excluded from interning. This makes any secret string over 40 bytes vulnerable to potential timing attacks. Additionally, if a secret string contains non-ASCII (unicode) characters, it may be longer than 40 bytes when encoded as UTF-8 even if it is fewer than 40 characters long. The vulnerability has been assigned a CVSS score of 4.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:U) (OSS Security).

The vulnerability could potentially allow an attacker to reveal the contents of secret strings through timing attacks. This particularly affects modules like mod_auth_internal_plain, where an attacker might discover a user's password if it's longer than 40 bytes, and mod_muc, where MUC passwords could be exposed through timing attacks. However, a successful timing attack would require a significant number of failed attempts to guess the contents of the secret string (OSS Security).

The vulnerability requires a high level of sophistication to exploit, as indicated by its CVSS score. No known proof-of-concept exploit exists, and there are no reported cases of this vulnerability being exploited in the wild. To successfully perform a timing attack, an attacker would need to make a significant number of failed attempts to guess the contents of the secret string (OSS Security).

For mod_auth_internal_plain, it is recommended to upgrade to mod_auth_internal_hashed. For mod_muc, users should use affiliations to grant access instead of passwords, or ensure passwords are shorter than 40 bytes. Rate limits can be enabled to greatly increase the time required to successfully complete a timing attack. The vulnerability is fully patched in Prosody version 0.11.9, which implements constant-time string comparison for secrets (OSS Security, Debian LTS).

The vulnerability was addressed promptly by major Linux distributions including Debian, Fedora, and Gentoo, which released security updates to patch the vulnerability. Debian issued security advisory DSA-4916-1, while Fedora released updates for versions 32, 33, and 34 (Debian Security, Gentoo Security).