CVE-2024-0914

A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS#1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption or signing, even without access to the corresponding private key.

A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS#1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption or signing, even without access to the corresponding private key.

openCryptoki is an implementation of the PKCS #11 API that allows interfacing to devices that hold cryptographic information and perform cryptographic functions. openCryptoki provides application portability by isolating the application from the details of the cryptographic device. Isolating the application also provides an added level of security. The openCryptoki API provides a standard programming interface between applications and all kinds of portable cryptographic devices.

Security Fix(es):

A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS#1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption or signing, even without access to the corresponding private key.(CVE-2024-0914)

openCryptoki is a PKCS#11 library and tools for Linux and AIX. In 3.25.0 and 3.26.0, there is a heap buffer overflow vulnerability in the CKM_ECDH_AES_KEY_WRAP implementation allows an attacker with local access to cause out-of-bounds writes in the host process by supplying a compressed EC public key and invoking C_WrapKey. This can lead to heap corruption, or denial-of-service.(CVE-2026-22791)

openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. Versions 2.3.2 and above are vulnerable to symlink-following when running in privileged contexts. A token-group user can redirect file operations to arbitrary filesystem targets by planting symlinks in group-writable token directories, resulting in privilege escalation or data exposure. Token and lock directories are 0770 (group-writable for token users), so any token-group member can plant files and symlinks inside them. When run as root, the base code handling token directory file access, as well as several openCryptoki tools used for administrative purposes, may reset ownership or permissions on existing files inside the token directories. An attacker with token-group membership can exploit the system when an administrator runs a PKCS#11 application or administrative tool that performs chown on files inside the token directory during normal maintenance. This issue is fixed in commit 5e6e4b4, but has not been included in a released version at the time of publication.(CVE-2026-23893)

A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS#1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption or signing, even without access to the corresponding private key.

The opencryptoki packages contain version 2.11 of the PKCS#11 API, implemented for IBM Cryptocards, such as IBM 4764 and 4765 crypto cards. These packages includes support for the IBM 4758 Cryptographic CoProcessor (with the PKCS#11 firmware loaded), the IBM eServer Cryptographic Accelerator (FC 4960 on IBM eServer System p), the IBM Crypto Express2 (FC 0863 or FC 0870 on IBM System z), and the IBM CP Assist for Cryptographic Function (FC 3863 on IBM System z). The opencryptoki packages also bring a software token implementation that can be used without any cryptographic hardware. These packages contain the Slot Daemon (pkcsslotd) and general utilities.

Security Fix(es):

• opencryptoki: timing side-channel in handling of RSA PKCS#1 v1.5 padded ciphertexts (Marvin) (CVE-2024-0914)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The opencryptoki packages contain version 2.11 of the PKCS#11 API, implemented for IBM Cryptocards, such as IBM 4764 and 4765 crypto cards. These packages includes support for the IBM 4758 Cryptographic CoProcessor (with the PKCS#11 firmware loaded), the IBM eServer Cryptographic Accelerator (FC 4960 on IBM eServer System p), the IBM Crypto Express2 (FC 0863 or FC 0870 on IBM System z), and the IBM CP Assist for Cryptographic Function (FC 3863 on IBM System z). The opencryptoki packages also bring a software token implementation that can be used without any cryptographic hardware. These packages contain the Slot Daemon (pkcsslotd) and general utilities.

Security Fix(es):

• opencryptoki: timing side-channel in handling of RSA PKCS#1 v1.5 padded ciphertexts (Marvin) (CVE-2024-0914)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2024-0914: fix timing side-channel in RSA PKCS#1 v1.5 decryption (Marvin)

A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS#1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption or signing, even without access to the corresponding private key. (CVE-2024-0914)

openCryptoki is an implementation of the PKCS #11 API that allows interfacing to devices that hold cryptographic information and perform cryptographic functions. openCryptoki provides application portability by isolating the application from the details of the cryptographic device. Isolating the application also provides an added level of security. The openCryptoki API provides a standard programming interface between applications and all kinds of portable cryptographic devices.

Security Fix(es):

A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS#1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption or signing, even without access to the corresponding private key.(CVE-2024-0914)

These are all security issues fixed in the openCryptoki-3.23.0-4.1 package on the GA media of openSUSE Tumbleweed.

The opencryptoki packages contain version 2.11 of the PKCS#11 API, implemented for IBM Cryptocards, such as IBM 4764 and 4765 crypto cards. These packages includes support for the IBM 4758 Cryptographic CoProcessor (with the PKCS#11 firmware loaded), the IBM eServer Cryptographic Accelerator (FC 4960 on IBM eServer System p), the IBM Crypto Express2 (FC 0863 or FC 0870 on IBM System z), and the IBM CP Assist for Cryptographic Function (FC 3863 on IBM System z). The opencryptoki packages also bring a software token implementation that can be used without any cryptographic hardware. These packages contain the Slot Daemon (pkcsslotd) and general utilities.

Security Fix(es):

• opencryptoki: timing side-channel in handling of RSA PKCS#1 v1.5 padded ciphertexts (Marvin) (CVE-2024-0914)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for openCryptoki fixes the following issues:

Upgrade openCryptoki to version 3.23 (jsc#PED-3360, jsc#PED-3361)

• EP11: Add support for FIPS-session mode
• CVE-2024-0914: Updates to harden against RSA timing attacks (bsc#1219217)
• Bug fixes

• provide user(pkcs11) and group(pkcs11)

Upgrade to version 3.22 (jsc#PED-3361)

• CCA: Add support for the AES-XTS key type using CPACF protected keys
• p11sak: Add support for managing certificate objects
• p11sak: Add support for public sessions (no-login option)
• p11sak: Add support for logging in as SO (security Officer)
• p11sak: Add support for importing/exporting Edwards and Montgomery keys
• p11sak: Add support for importing of RSA-PSS keys and certificates
• CCA/EP11/Soft/ICA: Ensure that the 2 key parts of an AES-XTS key are different

Update to version 3.21 (jsc#PED-3360, jsc#PED-3361)

• EP11 and CCA: Support concurrent HSM master key changes
• CCA: protected-key option
• pkcsslotd: no longer run as root user and further hardening
• p11sak: Add support for additional key types (DH, DSA, generic secret)
• p11sak: Allow wildcards in label filter
• p11sak: Allow to specify hex value for CKA_ID attribute
• p11sak: Support sorting when listing keys
• p11sak: New commands: set-key-attr, copy-key to modify and copy keys
• p11sak: New commands: import-key, export-key to import and export keys
• Remove support for --disable-locks (transactional memory)
• Updates to harden against RSA timing attacks
• Bug fixes

This update for openCryptoki fixes the following issues:

openCryptoki was updated to version to 3.17.0 (bsc#1220266, bsc#1219217)

• openCryptoki 3.17

• tools: added function to list keys to p11sak
• common: added support for OpenSSL 3.0
• common: added support for event notifications
• ICA: added SW fallbacks

• openCryptoki 3.16

• EP11: protected-key option
• EP11: support attribute-bound keys
• CCA: import and export of secure key objects
• Bug fixes

• openCryptoki 3.15.1

• Bug fixes

• openCryptoki 3.15

• common: conform to PKCS 11 3.0 Baseline Provider profile
• Introduce new vendor defined interface named 'Vendor IBM'
• Support C_IBM_ReencryptSingle via 'Vendor IBM' interface
• CCA: support key wrapping
• SOFT: support ECC
• p11sak tool: add remove-key command
• Bug fixes

• openCryptoki 3.14

• EP11: Dilitium support stage 2
• Common: Rework on process and thread locking
• Common: Rework on btree and object locking
• ICSF: minor fixes
• TPM, ICA, ICSF: support multiple token instances
• new tool p11sak

• openCryptoki 3.13.0

• EP11: Dilithium support
• EP11: EdDSA support
• EP11: support RSA-OAEP with non-SHA1 hash and MGF

• openCryptoki 3.12.1

• Fix pkcsep11_migrate tool

• openCryptoki 3.12.0

• Update token pin and data store encryption for soft,ica,cca and ep11
• EP11: Allow importing of compressed EC public keys
• EP11: Add support for the CMAC mechanisms
• EP11: Add support for the IBM-SHA3 mechanisms
• SOFT: Add AES-CMAC and 3DES-CMAC support to the soft token
• ICA: Add AES-CMAC and 3DES-CMAC support to the ICA token
• EP11: Add config option USE_PRANDOM
• CCA: Use Random Number Generate Long for token_specific_rng()
• Common rng function: Prefer /dev/prandom over /dev/urandom
• ICA: add SHA*_RSA_PKCS_PSS mechanisms
• Bug fixes