Go Variable Time Instruction Vulnerability in P-256 Implementation on ppc64le Architecture

A vulnerability exists in the Go programming language's assembly implementation of the P-256 elliptic curve cryptography, specifically on the ppc64le architecture. The issue arises from the use of a variable time instruction in an internal function, which inadvertently leaks a small number of bits from secret scalars. This leakage, however, is not believed to be sufficient for recovering private keys in well-known protocols that use P-256.

Impact

Exploitation of this vulnerability could lead to the unauthorized disclosure of sensitive information, specifically a small number of bits from secret scalars used in P-256 elliptic curve cryptography.

Reproduction

The vulnerability can be reproduced by using a version of Go that is affected by this issue, specifically Go versions prior to 1.22.12, from 1.23.0-0 before 1.23.6, and from 1.24.0-0 before 1.24.0-rc.3. The vulnerability occurs in the assembly implementation of the P-256 elliptic curve functions in the crypto/internal/nistec package, on the ppc64le architecture. The variable time instruction in the p256NegCond function causes the timing side-channel vulnerability, leaking bits of secret scalars.

Remediation

Users can upgrade to Go versions 1.22.12, 1.23.6, or 1.24.0-rc.3, which include the necessary patch to address this vulnerability.