Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS00Z3J4LTJ4OXctNTk2Y84AA3Z-

Marvin Attack: potential key recovery through timing sidechannels

The Marvin Attack is a timing sidechannel vulnerability which allows performing RSA decryption and signing operations as an attacker with the ability to observe only the time of the decryption operation performed withthe private key.

A recent survey of RSA implementations found that the Rust rsa crate is one of many implementations vulnerable to this attack.

No fixed version is available at this time.

Permalink: https://github.com/advisories/GHSA-4grx-2x9w-596c
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00Z3J4LTJ4OXctNTk2Y84AA3Z-
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 10 months ago
Updated: 9 months ago

CVSS Score: 5.9
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Identifiers: GHSA-4grx-2x9w-596c
References:

• https://github.com/RustCrypto/RSA/security/advisories/GHSA-c38w-74pg-36hr
• https://github.com/RustCrypto/RSA/issues/19#issuecomment-1822995643
• https://rustsec.org/advisories/RUSTSEC-2023-0071.html
• https://github.com/advisories/GHSA-4grx-2x9w-596c

Repository: https://github.com/RustCrypto/RSA
Blast Radius: 20.6

Affected Packages