IBM Common Cryptographic Architecture information disclosure

Vulnerability

IBM Common Cryptographic Architecture (CCA) versions 7.0.0 through 7.5.51 (including the IBM 4769 Developers Toolkit) contain a timing side-channel vulnerability in certain RSA operations. The vulnerability arises from an observable discrepancy (CWE-203) in the cryptographic implementation, which can be exploited to leak sensitive information [1].

Exploitation

An attacker with network access to the system can perform a timing attack by measuring the execution time of RSA operations. No authentication is required (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). The attacker must be able to send requests and observe response times with sufficient precision to extract information.

Impact

Successful exploitation allows the attacker to obtain sensitive information, such as cryptographic key material or plaintext, due to the timing leakage. The confidentiality impact is low (CVSS 3.7), meaning only limited information is disclosed.

Mitigation

IBM has provided a fix for this vulnerability. Affected users should apply the latest update from IBM as referenced in the security bulletin [1]. No workarounds are mentioned in the available references.