CVE-2024-0553: 
NixOS vulnerability analysis and mitigation

CVE-2024-0553 is a vulnerability discovered in GnuTLS that affects the RSA-PSK key exchange implementation. The vulnerability was identified as an incomplete fix for CVE-2023-5981, where response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue was disclosed on January 16, 2024, and affects GnuTLS versions prior to 3.8.3 (GnuTLS Release).

The vulnerability is a timing side-channel attack in the RSA-PSK key exchange implementation. When tested with affected versions, after collecting 203M measurements per probe on an aarch64 platform, definite side-channel signals were detected with a Friedman test p-value of 3.410443646538283e-25, indicating the implementation was vulnerable. The CVSS v3.1 base score for this vulnerability is 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) (Red Hat CVE).

Successful exploitation of this vulnerability could allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data (NVD).

The vulnerability has been fixed in GnuTLS version 3.8.3. Users are advised to upgrade to this version or later. Various Linux distributions have released security updates to address this vulnerability, including Red Hat Enterprise Linux, Fedora, and Debian (Red Hat Advisory, Debian Advisory).