Timing-based Side Channel Attack in nss
Summary
CVE-2020-12400: When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack. Affects nss versions < 3.55-r0. Fixed in 3.55-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The nss package is a cryptographic library used by various applications to provide secure communication over the internet. It includes functions for encryption, decryption, digital signatures, and certificate management. The package is widely used in web browsers, email clients, and other networked applications. However, a vulnerability has been discovered in nss that could potentially allow an attacker to perform a timing-based side channel attack.
Vulnerability Detail
The vulnerability, identified as CVE-2020-12400, arises when converting coordinates from projective to affine in nss. The modular inversion process during this conversion is not performed in constant time, which opens up the possibility of a timing-based side channel attack. An attacker could exploit this vulnerability to gain sensitive information by measuring the time it takes for the conversion process to complete. This vulnerability affects Firefox versions prior to 80 and Firefox for Android versions prior to 80.
How To Fix
Minimum fixed version
3.55-r0
This is the first release that contains the fix.
sudo apk add --upgrade nssTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the nss package to the fixed version to mitigate the risk of a timing-based side channel attack.
Conclusion
The timing-based side channel attack vulnerability in nss can be mitigated by updating the package to version 3.55-r0 or later. It is crucial for users to apply the necessary patches to protect their systems from potential attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nss →
FAQ
nss is a cryptographic library used for secure communication in various applications.
A timing-based side channel attack is a type of attack that exploits variations in the time taken by a system to perform certain operations, revealing sensitive information.
Firefox versions prior to 80 and Firefox for Android versions prior to 80 are affected.
Users should check for updates from their distribution or package manager and apply the necessary patches.
There is no known workaround for this vulnerability. Updating the nss package is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for nss.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
