4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-6135

CVE-2023-6135: Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva". This...

Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva". This attack could potentially allow an attacker to recover the private key. This vulnerability affects Firefox < 121.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-6135

CVE-2023-6135:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a side-channel attack (Minerva) affecting ECDSA implementations for NIST P-256, P-384, and P-521 curves in NSS. The attack allows potential recovery of the private key by observing timing variations during the signing process, specifically related to the handling of the nonce 'k'.

The Bugzilla report (1853908) is the primary source of information. It details that the SEC_SignData API was used for testing and that the leak was identified in the k-generation phase of ECDSA. Specific lines in lib/freebl/ec.c (related to MPI object normalization for 'k') were initially suspected.

The patches mentioned in the Bugzilla report (though not directly accessible as commit diffs via the tool) targeted these NIST curves. The functions ec_secp256r1_sign_digest, ec_secp384r1_sign_digest, and ec_secp521r1_sign_digest are the specific implementations for ECDSA signing for these curves within lib/freebl/ec.c. These are the functions where the vulnerable cryptographic operations involving the nonce 'k' occur.

The ECDSA_SignDigest function is responsible for generating the nonce 'k' and calling the lower-level curve-specific signing functions. Therefore, it is also a key part of the vulnerable pathway.

While SEC_SignData is the high-level API entry point, the actual vulnerability lies deeper in the cryptographic implementation specific to each curve. The identified functions are those that would be active during the signing operation and where the timing leak would manifest, making them appear in a runtime profile during exploitation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.