GHSA-4grx-2x9w-596c: Marvin Attack: potential key recovery through timing sidechannels
5.9
CVSS Score
3.1
Basic Information
CVE ID
-
GHSA ID
EPSS Score
-
CWE
Published
11/28/2023
Updated
12/14/2023
KEV Status
No
Technology
Rust
Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| rsa | rust | <= 0.9.6 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The advisory and linked GitHub issue #19 specifically identify timing variations in rsa::internals::encrypt() through fuzzing tests. The function's role in RSA encryption/decryption operations makes it a prime candidate for key-related timing leaks. While modpow implementations are often vulnerable in RSA timing attacks, the provided evidence directly points to encrypt() as the measured vulnerable function. The confidence is high due to reproducible timing differences and explicit mention in the issue discussion.