Headline
GHSA-4grx-2x9w-596c: Marvin Attack: potential key recovery through timing sidechannels
The Marvin Attack is a timing sidechannel vulnerability which allows performing RSA decryption and signing operations as an attacker with the ability to observe only the time of the decryption operation performed withthe private key.
A recent survey of RSA implementations found that the Rust rsa crate is one of many implementations vulnerable to this attack.
No fixed version is available at this time.
Package
cargo rsa (Rust)
Affected versions
<= 0.9.5
Patched versions
None
Description
The Marvin Attack is a timing sidechannel vulnerability which allows performing RSA decryption and signing operations as an attacker with the ability to observe only the time of the decryption operation performed withthe private key.
A recent survey of RSA implementations found that the Rust rsa crate is one of many implementations vulnerable to this attack.
No fixed version is available at this time.
References
- GHSA-c38w-74pg-36hr
- RustCrypto/RSA#19 (comment)
- https://rustsec.org/advisories/RUSTSEC-2023-0071.html
Published to the GitHub Advisory Database
Nov 28, 2023
Reviewed
Nov 28, 2023