title: Vault Vulnerable to Cache-Timing Attacks During Seal and Unseal Operations
description: HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a brute force effort to recover the Shamir shares. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.
problem types: CWE-208 Observable Timing Discrepancy
affected:
{
vendor: HashiCorp
product: Vault
platforms: [Windows, MacOS, Linux, x86, ARM, 64 bit, 32 bit]
repo: https://github.com/hashicorp/vault
versions:
status: affected, version: 1.13.0, lessThan: 1.13.1, versionType: semver
status: affected, version: 1.12.0, lessThan: 1.12.5, versionType: semver
status: affected, version: 1.11.0, lessThan: 1.11.9, versionType: semver
status: affected, version: 0, lessThan: 1.11.0, versionType: semver
defaultStatus: unaffected
}
{
vendor: HashiCorp
product: Vault Enterprise
platforms: [Windows, MacOS, Linux, x86, ARM, 64 bit, 32 bit]
versions:
status: affected, version: 1.13.0, lessThan: 1.13.1, versionType: semver
status: affected, version: 1.12.0, lessThan: 1.12.5, versionType: semver
status: affected, version: 1.11.0, lessThan: 1.11.9, versionType: semver
status: affected, version: 0, lessThan: 1.11.0, versionType: semver
defaultStatus: unaffected
}
metrics:
format: CVSS
scenarios: GENERAL
cvssV3_1: [
version: 3.1
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 5
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N
]