Loading vulnerability…
OpenSSL ECDSA Nonce Recovery via FLUSH+RELOAD
CVE-2014-0076 is a cache side-channel vulnerability in OpenSSL's Montgomery ladder implementation, affecting OpenSSL through version 1.0.0l and vulnerable vendor-bundled builds. Certain swap operations do not execute with constant-time behavior, exposing secret-dependent execution patterns during elliptic-curve operations. A local attacker can monitor a victim signing process using FLUSH+RELOAD to recover ECDSA nonce information, potentially enabling reconstruction of the ECDSA private signing key.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the confidentiality of ECDSA signing material. Recovery of sufficient nonce information can enable private-key reconstruction and subsequent signature forgery or impersonation wherever that key is trusted. The vulnerability is a local cryptographic information-disclosure issue; remote code execution and denial of service are not established consequences of this flaw.
If you can’t patch tonight, do this now.
No complete general workaround is established. Preventing untrusted local code execution reduces exposure to the required cache monitoring. For pfSense installations using imported ECDSA certificates, replace those certificates with non-ECDSA certificates if an immediate update is not possible. Network access restrictions alone do not address the local cache side channel.
Patch, then assume compromise.
Apply an OpenSSL or product-vendor update that incorporates the CVE-2014-0076 fix, including updates to independently bundled OpenSSL libraries. Documented historical fixes include pfSense 2.1.2 and its separately updated packages, corrected FreeBSD releases or patches, and OpenSSL port/package version 1.0.1_10 or later on FreeBSD. HP-UX updates begin with the release-specific OpenSSL A.00.09.08za revisions. Restart applications using the affected library or reboot after patching. Replace potentially compromised ECDSA private keys and associated certificates after correcting the vulnerable implementation.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
24 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.