CVE-2023-6135

What it actually does

Side-channel attack (Minerva) on multiple NSS NIST elliptic curves enables recovery of the private key through observable timing or cache behavior during cryptographic operations.

Why it matters to the business

Potential compromise of private keys could expose encrypted communications or enable impersonation on systems using vulnerable NSS packages, though low exploit likelihood and absence from known campaigns limit immediate operational disruption; update Debian 11 systems promptly to avoid exposure in widely deployed environments.

How an attack unfolds

An attacker with network or local access observes side-channel leakage during repeated NIST curve operations in NSS, applies the Minerva technique to statistically recover the private key, then uses the extracted key to decrypt traffic or forge signatures.

How to fix it

Upgrade NSS packages on Debian 11 to version 5.10.205-1 or later; for Firefox users ensure version 121 or newer is deployed; apply vendor patches across all affected linux distributions immediately.

How to confirm the fix worked

Verify installed NSS or Firefox package versions match or exceed the fixed releases; re-run cryptographic operations and confirm absence of the previously exploitable curve implementations.

Typical attack path

1. Identify targets running vulnerable NSS versions in Firefox or dependent applications
2. Trigger or observe multiple elliptic-curve cryptographic operations
3. Collect timing, cache, or power side-channel measurements
4. Process measurements offline with Minerva analysis to extract the private key
5. Decrypt protected data or impersonate the key owner

How to detect it

Examine system and application logs for repeated cryptographic calls involving NSS NIST curves; look for unusual process behavior around libnss or Firefox binaries that might indicate side-channel data collection attempts.

What your security team should do

• Apply the Debian 5.10.205-1 NSS update to all linux systems within the next maintenance window
• Audit applications that depend on NSS for NIST curve usage and prioritize upgrades
• Monitor vendor advisories for any additional affected products and schedule phased rollouts