CVE-2020-12402 Information disclosure in Firefox
Electromagnetic side-channel attacks during RSA key generation can recover secret primes, affecting products built on Firefox.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-12402?
CVE-2020-12402 is a medium-severity vulnerability in Debian Debian Linux, published on 9 Jul 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes. *Note:* An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected, but products built on top of it might. This vulnerability affects Firefox < 78.
Weakness: CWE-203
Which versions are affected by CVE-2020-12402?
It affects 4 products.
Linux distribution packages (10)
mozilla-nss SUSE:Linux Enterprise High Performance Computing 15-ESPOS | All versions | 3.53.1-3.45.1 |
mozilla-nss SUSE:Linux Enterprise High Performance Computing 15-LTSS | All versions | 3.53.1-3.45.1 |
mozilla-nss SUSE:Linux Enterprise Module for Basesystem 15 SP1 | All versions | 3.53.1-3.45.1 |
mozilla-nss SUSE:Linux Enterprise Module for Basesystem 15 SP2 | All versions | 3.53.1-3.45.1 |
mozilla-nss SUSE:Linux Enterprise Module for Server Applications 15 SP1 | All versions | 3.53.1-3.45.1 |
mozilla-nss SUSE:Linux Enterprise Module for Server Applications 15 SP2 | All versions | 3.53.1-3.45.1 |
mozilla-nss SUSE:Linux Enterprise Server 15-LTSS | All versions | 3.53.1-3.45.1 |
mozilla-nss SUSE:Linux Enterprise Server for SAP Applications 15 | All versions | 3.53.1-3.45.1 |
mozilla-nss openSUSE:Leap 15.1 | All versions | 3.53.1-lp151.2.26.1 |
mozilla-nss openSUSE:Leap 15.2 | All versions | 3.53.1-lp152.2.4.1 |
Products include Debian Debian Linux, Fedoraproject Fedora, Mozilla Firefox, Opensuse Leap.
How do I fix CVE-2020-12402?
Upgrade to a fixed version.
Is CVE-2020-12402 being exploited?
There is no known exploitation of CVE-2020-12402 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2020-12402, DEBIAN-CVE-2020-12402, GHSA-p7qx-fg8r-mfq9, SUSE-SU-2020:1850-1, UBUNTU-CVE-2020-12402, USN-4417-1 and 3 more.