IBM Common Cryptographic Architecture information disclosure

Vulnerability

IBM Common Cryptographic Architecture (CCA) versions 7.0.0 through 7.5.51 contain a timing side-channel vulnerability during the creation of ECDSA signatures. This flaw, classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), allows a remote attacker to observe timing discrepancies and infer sensitive information. The affected products include CCA 7.x MTM for 4769 on IBM AIX, IBM i, IBM PowerLinux, Linux (Intel x86 platforms), and the IBM 4769 Developers Toolkit [1].

Exploitation

An attacker can exploit this vulnerability remotely without authentication (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). The attack requires user interaction (UI:R) and low complexity (AC:L). The attacker sends requests to the CCA service to generate ECDSA signatures and measures the response times. By analyzing timing variations, the attacker can deduce secret key material or other sensitive data used in the signature process [1].

Impact

Successful exploitation results in high confidentiality impact, as the attacker obtains sensitive information such as cryptographic keys or other secret data involved in ECDSA signature generation. There is no integrity or availability impact. The CVSS base score is 6.5, indicating a moderate severity [1].

Mitigation

IBM has provided fixes for this vulnerability. Users should upgrade to the latest version of IBM Common Cryptographic Architecture as specified in the IBM security bulletin (https://www.ibm.com/support/pages/node/7185282). No workarounds are documented in the available references [1].