22.7 BERserk attack
In 2014, Intel’s advanced threat research team and the French security researcher Antoine Delignat-Lavaud discovered a critical vulnerability in the then-current version of Mozilla’s Network Security Services (NSS) cryptographic library [85]. The attack was assigned the CVE number CVE-2014-1569.
The researchers gave the vulnerability the name BERserk, which is a pun on the Basic Encoding Rules (BER) encoding format. BER is a set of rules specified in International Telecommunications Union’s ASN.1 standard for encoding data into binary form.
NSS versions vulnerable to BERserk do not ensure that the BER encoding of an ASN.1 length is correctly formed. This, in turn, allows Mallory to forge RSA signatures using the PKCS#1 v1.5 RSA Signature Forgery attack published earlier by Daniel Bleichenbacher.
According to the PKCS#1 v1.5 standard, a plaintext’s hash to be signed must be padded as follows:
00 01 FF FF .. FF FF 00 DigestInfo MessageDigest...
