Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-49092

CVE-2023-49092:
Marvin Attack: potential key recovery through timing sidechannels

5.9

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-49092
GHSA ID
GHSA-c38w-74pg-36hr
EPSS Score
0.71812%
CWE
CWE-203
Published
11/28/2023
Updated
12/15/2023
KEV Status
No
Technology
TechnologyRust

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
rsarust<= 0.9.6

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

  1. The GitHub issue #19 explicitly identifies rsa::internals::encrypt as showing variable timing behavior. 2. The Marvin Attack context suggests RSA primitive implementations (like modpow) are vulnerable. 3. Cryptographic literature shows modular exponentiation is a classic source of timing leaks. 4. The lack of patches indicates fundamental algorithm-level issues rather than specific helper functions. 5. The CWE-385 (Timing Channel) classification confirms this type of vulnerability pattern.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t *u* to * non-*onst*nt-tim* impl*m*nt*tion, in*orm*tion **out t** priv*t* k*y is l**k** t*rou** timin* in*orm*tion w*i** is o*s*rv**l* ov*r t** n*twork. *n *tt**k*r m*y ** **l* to us* t**t in*orm*tion to r**ov*r t** k*y. ### P*t***s No p*t

Reasoning

*. T** *it*u* issu* #** *xpli*itly i**nti*i*s rs*::int*rn*ls::*n*rypt *s s*owin* v*ri**l* timin* ****vior. *. T** M*rvin *tt**k *ont*xt su***sts RS* primitiv* impl*m*nt*tions (lik* mo*pow) *r* vuln*r**l*. *. *rypto*r*p*i* lit*r*tur* s*ows mo*ul*r *xp