CVE-2024-2408: 
PHP vulnerability analysis and mitigation

The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack. This vulnerability affects PHP versions 8.1.0 through 8.1.29, 8.2.0 through 8.2.20, and 8.3.0 through 8.3.8, unless used with an OpenSSL version that includes the rsa_pkcs1_implicit_rejection changes. The vulnerability was disclosed in June 2024 and has been assigned a CVSS v3.1 base score of 5.9 (Medium) (NVD, PHP Advisory).

The vulnerability is a timing side-channel attack known as the Marvin Attack, which affects the RSA decryption implementation using PKCS#1 v1.5 padding in OpenSSL. The execution time of the openssl_private_decrypt() function varies based on whether a valid message is returned, creating a timing oracle that can be exploited in a Bleichenbacher-style attack. Statistical analysis has demonstrated the presence of this side channel, with tests showing significant timing differences between valid and invalid messages (Red Hat).

The vulnerability allows attackers to potentially decrypt captured ciphertexts or forge signatures using the key used in the decryption API. While the vulnerability poses a real threat, its practical exploitation requires high precision and a large number of measurements to discern timing differences accurately. The attack necessitates the ability to send numerous crafted ciphertexts to the decryption function and accurately measure response times (PHP Advisory).

The vulnerability requires network access and high attack complexity, with no privileges or user interaction required. The attack has been demonstrated through statistical analysis of execution times, confirming the presence of a side channel that can be leveraged in a Bleichenbacher-style attack. Testing with 100k measurements per probe showed statistically significant timing differences (PHP Advisory).

The vulnerability is fixed in PHP Windows builds for versions 8.1.29, 8.2.20, and 8.3.8 and above. The fix requires using an OpenSSL version that includes the changes from the rsa_pkcs1_implicit_rejection pull request (https://github.com/openssl/openssl/pull/13817). These changes are part of OpenSSL 3.2 and have been backported to stable versions of various Linux distributions (NVD).