CVE-2023-26557: IO FinNet tss-lib vulnerable to timing attack from non-constant time scalar arithmetic
(updated )
io.finnet tss-lib before 2.0.0 can leak the lambda value of a private key via a timing side-channel attack because it relies on Go big.Int, which is not constant time for Cmp, modular exponentiation, or modular inverse. An example leak is in crypto/paillier/paillier.go. (bnb-chain/tss-lib and thorchain/tss are also affected.)
References
- github.com/IoFinnet/tss-lib/releases/tag/v2.0.0
- github.com/advisories/GHSA-mjqv-xhgm-gx8c
- github.com/bnb-chain/tss-lib
- github.com/bnb-chain/tss-lib/tree/v1.3.5
- gitlab.com/thorchain/tss/tss-lib/-/tags/v0.1.3
- medium.com/@iofinnet/security-disclosure-for-ecdsa-and-eddsa-threshold-signature-schemes-4e969af7155b
- nvd.nist.gov/vuln/detail/CVE-2023-26557
- pkg.go.dev/vuln/GO-2023-1733
Code Behaviors & Features
Detect and mitigate CVE-2023-26557 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →