CVE-2020-12402

During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes. Note: An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected, but products built on top of it might. This vulnerability affects Firefox < 78.

During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes. Note: An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected, but products built on top of it might. This vulnerability affects Firefox < 78.

Network Security Services (NSS) is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other security standards.

Security Fix(es):

In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a buffer overflow.(CVE-2019-17006)

In Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to crash, resulting in a denial of service.(CVE-2019-17007)

A use-after-free flaw was found in Mozilla Network Security Services (NSS) related to PK11 session handling. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled with NSS.(CVE-2019-11756)

A flaw was found in NSS, where it is vulnerable to RSA key generation cache timing side-channel attacks. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. The highest threat to this flaw is to confidentiality.(CVE-2020-12402)

Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications.

Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities.

The following packages have been upgraded to a later upstream version: nss (3.53.1), nspr (4.25.0). (BZ#1809549, BZ#1809550)

Security Fix(es):

• nss: UAF in sftk_FreeSession due to improper refcounting (CVE-2019-11756)

• nss: Check length of inputs for cryptographic primitives (CVE-2019-17006)

• nss: Side channel vulnerabilities during RSA key generation (CVE-2020-12402)

• nss: TLS 1.3 HelloRetryRequest downgrade request sets client into invalid state (CVE-2019-17023)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Install of update of nss.x86_64 adds i686 into transaction (BZ#1663187)

• NSS does not set downgrade sentinel in ServerHello.random for TLS 1.0 and TLS 1.1 (BZ#1691409)

• TLS Keying Material Exporter is unsupported by command line tools (BZ#1691454)

• TLS_AES_256_GCM_SHA384 is not marked as FIPS compatible (BZ#1711375)

• Make TLS 1.3 work in FIPS mode (BZ#1724250)

• NSS rejects records with large padding with SHA384 HMAC (BZ#1750921)

• NSS missing IKEv1 Quick Mode KDF (BZ#1809637)

• Name Constraints validation: CN treated as DNS name even when syntactically invalid as DNS name (BZ#1825270)

• FIPS needs nss to restrict valid dh primes to those primes that are approved. (BZ#1854564)

• nss needs to comply to the new SP800-56A rev 3 requirements (BZ#1855825)

Enhancement(s):

• [RFE] nss should use AES for storage of keys (BZ#1723819)

During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes. Note: An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected, but products built on top of it might. This vulnerability affects Firefox < 78.

This update for mozilla-nss fixes the following issues:

mozilla-nss was updated to version 3.53.1

• CVE-2020-12402: Fixed a potential side channel attack during RSA key generation (bsc#1173032)
• Fixed various FIPS issues in libfreebl3 which were causing segfaults in the test suite of chrony (bsc#1168669).

This update was imported from the SUSE:SLE-15:Update update project.

This update for mozilla-nss fixes the following issues:

mozilla-nss was updated to version 3.53.1

• CVE-2020-12402: Fixed a potential side channel attack during RSA key generation (bsc#1173032)
• Fixed various FIPS issues in libfreebl3 which were causing segfaults in the test suite of chrony (bsc#1168669).

This update was imported from the SUSE:SLE-15:Update update project.

This update for MozillaFirefox to version 78.0.1 ESR fixes the following issues:

Security issues fixed:

• CVE-2020-12415: AppCache manifest poisoning due to url encoded character processing (bsc#1173576).
• CVE-2020-12416: Use-after-free in WebRTC VideoBroadcaster (bsc#1173576).
• CVE-2020-12417: Memory corruption due to missing sign-extension for ValueTags on ARM64 (bsc#1173576).
• CVE-2020-12418: Information disclosure due to manipulated URL object (bsc#1173576).
• CVE-2020-12419: Use-after-free in nsGlobalWindowInner (bsc#1173576).
• CVE-2020-12420: Use-After-Free when trying to connect to a STUN server (bsc#1173576).
• CVE-2020-12402: RSA Key Generation vulnerable to side-channel attack (bsc#1173576).
• CVE-2020-12421: Add-On updates did not respect the same certificate trust rules as software updates (bsc#1173576).
• CVE-2020-12422: Integer overflow in nsJPEGEncoder::emptyOutputBuffer (bsc#1173576).
• CVE-2020-12423: DLL Hijacking due to searching %PATH% for a library (bsc#1173576).
• CVE-2020-12424: WebRTC permission prompt could have been bypassed by a compromised content process (bsc#1173576).
• CVE-2020-12425: Out of bound read in Date.parse() (bsc#1173576).
• CVE-2020-12426: Memory safety bugs fixed in Firefox 78 (bsc#1173576).
• FIPS: MozillaFirefox: allow /proc/sys/crypto/fips_enabled (bsc#1167231).

Non-security issues fixed:

• Fixed interaction with freetype6 (bsc#1173613).

This update was imported from the SUSE:SLE-15:Update update project.

This update for MozillaFirefox to version 78.0.1 ESR fixes the following issues:

Security issues fixed:

• CVE-2020-12415: AppCache manifest poisoning due to url encoded character processing (bsc#1173576).
• CVE-2020-12416: Use-after-free in WebRTC VideoBroadcaster (bsc#1173576).
• CVE-2020-12417: Memory corruption due to missing sign-extension for ValueTags on ARM64 (bsc#1173576).
• CVE-2020-12418: Information disclosure due to manipulated URL object (bsc#1173576).
• CVE-2020-12419: Use-after-free in nsGlobalWindowInner (bsc#1173576).
• CVE-2020-12420: Use-After-Free when trying to connect to a STUN server (bsc#1173576).
• CVE-2020-12402: RSA Key Generation vulnerable to side-channel attack (bsc#1173576).
• CVE-2020-12421: Add-On updates did not respect the same certificate trust rules as software updates (bsc#1173576).
• CVE-2020-12422: Integer overflow in nsJPEGEncoder::emptyOutputBuffer (bsc#1173576).
• CVE-2020-12423: DLL Hijacking due to searching %PATH% for a library (bsc#1173576).
• CVE-2020-12424: WebRTC permission prompt could have been bypassed by a compromised content process (bsc#1173576).
• CVE-2020-12425: Out of bound read in Date.parse() (bsc#1173576).
• CVE-2020-12426: Memory safety bugs fixed in Firefox 78 (bsc#1173576).
• FIPS: MozillaFirefox: allow /proc/sys/crypto/fips_enabled (bsc#1167231).

Non-security issues fixed:

• Fixed interaction with freetype6 (bsc#1173613).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libfreebl3-3.69.1-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for mozilla-nspr, mozilla-nss fixes the following issues:

mozilla-nss was updated to version 3.53.1

• CVE-2019-11745: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate
• CVE-2020-12402: Fixed a potential side channel attack during RSA key generation (bsc#1173032).
• CVE-2020-12399: Fixed a timing attack on DSA signature generation (bsc#1171978).
• CVE-2019-17006: Added length checks for cryptographic primitives (bsc#1159819).
• CVE-2019-11727: A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages.
• Fixed various FIPS issues in libfreebl3 which were causing segfaults in the test suite of chrony (bsc#1168669).
• Fixed an issue where Firefox tab was crashing (bsc#1170908).

Release notes: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.53_release_notes

mozilla-nspr was updated to version 4.25.

This update for MozillaFirefox to version 78.0.1 ESR fixes the following issues:

Security issues fixed:

• CVE-2020-12415: AppCache manifest poisoning due to url encoded character processing (bsc#1173576).
• CVE-2020-12416: Use-after-free in WebRTC VideoBroadcaster (bsc#1173576).
• CVE-2020-12417: Memory corruption due to missing sign-extension for ValueTags on ARM64 (bsc#1173576).
• CVE-2020-12418: Information disclosure due to manipulated URL object (bsc#1173576).
• CVE-2020-12419: Use-after-free in nsGlobalWindowInner (bsc#1173576).
• CVE-2020-12420: Use-After-Free when trying to connect to a STUN server (bsc#1173576).
• CVE-2020-12402: RSA Key Generation vulnerable to side-channel attack (bsc#1173576).
• CVE-2020-12421: Add-On updates did not respect the same certificate trust rules as software updates (bsc#1173576).
• CVE-2020-12422: Integer overflow in nsJPEGEncoder::emptyOutputBuffer (bsc#1173576).
• CVE-2020-12423: DLL Hijacking due to searching %PATH% for a library (bsc#1173576).
• CVE-2020-12424: WebRTC permission prompt could have been bypassed by a compromised content process (bsc#1173576).
• CVE-2020-12425: Out of bound read in Date.parse() (bsc#1173576).
• CVE-2020-12426: Memory safety bugs fixed in Firefox 78 (bsc#1173576).
• FIPS: MozillaFirefox: allow /proc/sys/crypto/fips_enabled (bsc#1167231).

Non-security issues fixed:

• Fixed interaction with freetype6 (bsc#1173613).

This update for mozilla-nspr, mozilla-nss fixes the following issues:

mozilla-nss was updated to version 3.53.1

• CVE-2020-12402: Fixed a potential side channel attack during RSA key generation (bsc#1173032).
• CVE-2020-12399: Fixed a timing attack on DSA signature generation (bsc#1171978).
• CVE-2019-17006: Added length checks for cryptographic primitives (bsc#1159819).
• Fixed various FIPS issues in libfreebl3 which were causing segfaults in the test suite of chrony (bsc#1168669).
• Fixed an issue where Firefox tab was crashing (bsc#1170908).

Release notes: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.53_release_notes

mozilla-nspr to version 4.25

This update for mozilla-nss fixes the following issues:

mozilla-nss was updated to version 3.53.1

• CVE-2020-12402: Fixed a potential side channel attack during RSA key generation (bsc#1173032)
• Fixed various FIPS issues in libfreebl3 which were causing segfaults in the test suite of chrony (bsc#1168669).

This update for MozillaFirefox to version 78.0.1 ESR fixes the following issues:

Security issues fixed:

• CVE-2020-12415: AppCache manifest poisoning due to url encoded character processing (bsc#1173576).
• CVE-2020-12416: Use-after-free in WebRTC VideoBroadcaster (bsc#1173576).
• CVE-2020-12417: Memory corruption due to missing sign-extension for ValueTags on ARM64 (bsc#1173576).
• CVE-2020-12418: Information disclosure due to manipulated URL object (bsc#1173576).
• CVE-2020-12419: Use-after-free in nsGlobalWindowInner (bsc#1173576).
• CVE-2020-12420: Use-After-Free when trying to connect to a STUN server (bsc#1173576).
• CVE-2020-12402: RSA Key Generation vulnerable to side-channel attack (bsc#1173576).
• CVE-2020-12421: Add-On updates did not respect the same certificate trust rules as software updates (bsc#1173576).
• CVE-2020-12422: Integer overflow in nsJPEGEncoder::emptyOutputBuffer (bsc#1173576).
• CVE-2020-12423: DLL Hijacking due to searching %PATH% for a library (bsc#1173576).
• CVE-2020-12424: WebRTC permission prompt could have been bypassed by a compromised content process (bsc#1173576).
• CVE-2020-12425: Out of bound read in Date.parse() (bsc#1173576).
• CVE-2020-12426: Memory safety bugs fixed in Firefox 78 (bsc#1173576).
• FIPS: MozillaFirefox: allow /proc/sys/crypto/fips_enabled (bsc#1167231).

Non-security issues fixed:

• Fixed interaction with freetype6 (bsc#1173613).

This update for MozillaFirefox to version 78.0.1 ESR fixes the following issues:

Security issues fixed:

• CVE-2020-12415: AppCache manifest poisoning due to url encoded character processing (bsc#1173576).
• CVE-2020-12416: Use-after-free in WebRTC VideoBroadcaster (bsc#1173576).
• CVE-2020-12417: Memory corruption due to missing sign-extension for ValueTags on ARM64 (bsc#1173576).
• CVE-2020-12418: Information disclosure due to manipulated URL object (bsc#1173576).
• CVE-2020-12419: Use-after-free in nsGlobalWindowInner (bsc#1173576).
• CVE-2020-12420: Use-After-Free when trying to connect to a STUN server (bsc#1173576).
• CVE-2020-12402: RSA Key Generation vulnerable to side-channel attack (bsc#1173576).
• CVE-2020-12421: Add-On updates did not respect the same certificate trust rules as software updates (bsc#1173576).
• CVE-2020-12422: Integer overflow in nsJPEGEncoder::emptyOutputBuffer (bsc#1173576).
• CVE-2020-12423: DLL Hijacking due to searching %PATH% for a library (bsc#1173576).
• CVE-2020-12424: WebRTC permission prompt could have been bypassed by a compromised content process (bsc#1173576).
• CVE-2020-12425: Out of bound read in Date.parse() (bsc#1173576).
• CVE-2020-12426: Memory safety bugs fixed in Firefox 78 (bsc#1173576).
• FIPS: MozillaFirefox: allow /proc/sys/crypto/fips_enabled (bsc#1167231).

Non-security issues fixed:

• Fixed interaction with freetype6 (bsc#1173613).

Cesar Pereida, Billy Bob Brumley, Yuval Yarom, and Nicola Tuveri discovered that NSS incorrectly handled RSA key generation. A local attacker could possibly use this issue to perform a timing attack and recover RSA keys.

USN-4417-1 fixed a vulnerability in NSS. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.

Original advisory details:

Cesar Pereida, Billy Bob Brumley, Yuval Yarom, and Nicola Tuveri discovered that NSS incorrectly handled RSA key generation. A local attacker could possibly use this issue to perform a timing attack and recover RSA keys.