CVE-2022-4304

/// Technical description

A timing based side channel exists in the OpenSSL RSA Decryption implementation

which could be sufficient to recover a plaintext across a network in a

Bleichenbacher style attack. To achieve a successful decryption an attacker

would have to be able to send a very large number of trial messages for

decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5,

RSA-OEAP and RSASVE.

For example, in a TLS connection, RSA is commonly used by a client to send an

encrypted pre-master secret to the server. An attacker that had observed a

genuine connection between a client and a server could use this flaw to send

trial messages to the server and record the time taken to process them. After a

sufficiently large number of messages the attacker could recover the pre-master

secret used for the original connection and thus be able to decrypt the

application data sent over that connection.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References