CVE-2023-50979

Vulnerability

Crypto++ (cryptopp) versions through 8.9.0 contain a Marvin side-channel vulnerability in the decryption routine for PKCS#1 v1.5 padding [1]. The implementation does not perform constant-time processing when validating the padding structure, allowing an attacker to distinguish between valid and invalid ciphertexts via timing measurements.

Exploitation

An attacker with network access to a system using Crypto++ for RSA decryption with PKCS#1 v1.5 padding can send crafted ciphertexts and measure the decryption time. The attack requires the ability to observe precise timing differences (on the order of hundreds of nanoseconds) and typically thousands of measurement pairs to achieve statistical significance [1]. The reproducer provided in the marvin-toolkit repository demonstrates the attack on an AMD Ryzen 5 5600X system.

Impact

Successful exploitation allows an attacker to recover the plaintext of a chosen ciphertext, breaking the confidentiality of RSA-encrypted messages. This is a classic Bleichenbacher-style attack enabled by a timing side channel, leading to information disclosure of the decrypted data.

Mitigation

As of the publication date (2023-12-18), no fixed version has been released. Users are advised to monitor the Crypto++ repository for a patch. In the interim, switching to OAEP padding (PKCS#1 v2) or using a different cryptographic library that implements constant-time RSA decryption is recommended.