CVE-2024-0914: 
NixOS vulnerability analysis and mitigation

A timing side-channel vulnerability (CVE-2024-0914) was discovered in the opencryptoki package while processing RSA PKCS#1 v1.5 padded ciphertexts. The vulnerability was disclosed on January 31, 2024, affecting opencryptoki versions up to (excluding) 3.23.0 and various Red Hat Enterprise Linux distributions (NVD).

The vulnerability is a timing side-channel in the handling of RSA PKCS#1 v1.5 padded ciphertexts, which can be exploited by measuring the time differences in decryption operations. The vulnerability has a CVSS v3.1 Base Score of 5.9 (Medium) with vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N (Red Hat).

This flaw could potentially enable unauthorized RSA ciphertext decryption or signing operations without access to the corresponding private key. To achieve a successful decryption, an attacker would need to send a large number of specifically crafted messages to a service that uses the vulnerable API (Bugzilla).

The vulnerability requires significant effort to exploit, including sending a large number of meticulously crafted messages to a vulnerable API-utilizing service and precise timing control. The attack is considered moderate due to the complexity of exploitation (Bugzilla).

Red Hat has released security updates to address this vulnerability through multiple security advisories including RHSA-2024:1239, RHSA-2024:1411, RHSA-2024:1608, RHSA-2024:1856, and RHSA-2024:1992. Users should update their opencryptoki packages to the latest versions available for their specific Red Hat Enterprise Linux distributions (Red Hat).