CVE-2024-23953: apache software foundation apache hive Observable Timing Discrepancy

Vulnerability summary

CVE-2024-23953 is a medium (CVSS 6.5) Observable Timing Discrepancy vulnerability in apache software foundation apache hive. EPSS estimates a 1.31% chance of exploitation in the next 30 days, higher than 70.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 28-01-2025
   PublishedVulnerability first disclosed.
2. 14-03-2025
   Last modifiedVulnerability information updated.

Description

Use of Arrays.equals() in LlapSignerImpl in Apache Hive to compare message signatures allows attacker to forge a valid signature for an arbitrary message byte by byte. The attacker should be an authorized user of the product to perform this attack. Users are recommended to upgrade to version 4.0.0, which fixes this issue. The problem occurs when an application doesn’t use a constant-time algorithm for validating a signature. The method Arrays.equals() returns false right away when it sees that one of the input’s bytes are different. It means that the comparison time depends on the contents of the arrays. This little thing may allow an attacker to forge a valid signature for an arbitrary message byte by byte. So it might allow malicious users to submit splits/work with selected signatures to LLAP without running as a privileged user, potentially leading to DDoS attack. More details in the reference section.

• CWE-208Observable Timing DiscrepancyTwo separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.