OpenSSL: timing side channel in ECDSA signing can leak the private key

CVSS 5.9CVE-2018-0735Kernel, userspace & hypervisorcurated

Impact

The ECDSA signing path has the same shape of flaw as the DSA one but a different affected version set: variations in the algorithm let an attacker who can collect enough timed signatures recover the private key. ECDSA keys are far more widely deployed than DSA across a datacenter - internal TLS, service mesh identities, SSH - so the blast radius of a recovered key is larger, though the attack still needs many samples and precise timing, which strongly favours a local or co-resident attacker over a remote one. Confidentiality impact only; signing services keep working normally while the leak happens.

Who can reach it

An attacker able to request and precisely time many ECDSA signatures from the affected process. Local or same-host positioning is the realistic path; no authentication beyond access to the signing operation.

What to do

Upgrade OpenSSL to 1.1.1a or 1.1.0j, or the distribution backport (Red Hat: RHSA-2019:3700), and restart everything linked against libcrypto - including container images that bundle their own copy. Rotate any ECDSA key the affected service used, since a patch does not undo prior leakage. Fix commits are linked in the record.

References

https://nvd.nist.gov/vuln/detail/CVE-2018-0735 https://access.redhat.com/errata/RHSA-2019:3700 https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=56fb454d281a023b3f950d969693553d3f3ceea1 https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=b1d6d55ece1c26fa2829e2b819b038d7b6d692b4

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.