Critical Timing Side Channel Vulnerability in libcrypto++ Package
Summary
UBUNTU-CVE-2022-48570: Crypto++ through 8.4 contains a timing side channel in ECDSA signature generation. Affects libcrypto++ versions 5.6.1-6 – 5.6.1-6+deb8u3ubuntu0.1~esm1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libcrypto++ is a widely used C++ library that provides a rich set of cryptographic algorithms and protocols. It is essential for developers needing secure encryption, decryption, and hashing functionalities in their applications. However, the library has been found to have a significant vulnerability that can compromise the security of applications relying on it.
Vulnerability Detail
Crypto++ through version 8.4 contains a timing side channel vulnerability in ECDSA signature generation. The issue arises from the FixedSizeAllocatorWithCleanup function, which could write to memory outside of the allocated space if the memory was not aligned to a 16-byte boundary. This vulnerability exists because the fix for CVE-2019-14318 was intentionally removed to maintain certain functionalities, leading to potential security risks such as unauthorized access to sensitive data or manipulation of cryptographic operations.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can avoid using the affected ECDSA signature generation functions until the package is updated. Additionally, ensuring proper memory alignment in custom implementations may mitigate some risks.
Conclusion
The libcrypto++ package has a critical vulnerability that can lead to severe security risks. It is essential for users to update to the latest version to mitigate these risks. Understanding the nature of the vulnerability and implementing the recommended fixes will help maintain the integrity and security of applications utilizing this library.
See every vulnerability recorded for libcrypto++ →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Versions of libcrypto++ up to 8.4 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability could lead to unauthorized access to sensitive data or manipulation of cryptographic operations, compromising the security of applications.
Yes, updating to the latest patched version of the libcrypto++ package is the recommended permanent fix.
Related vulnerabilities
Recent vulnerabilities recorded for libcrypto++.
