# Padding oracle in AES-NI CBC MAC check (CVE-2016-2107)

AES-NI CBC MAC check in OpenSSL lacked a length check, creating a padding oracle that lets a MITM attacker decrypt TLS traffic.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: jurajsomorovsky
- Disclosed: 2016-05-19
- CVE: CVE-2016-2107
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/136986
- Library page: https://bugbountylibrary.com/r/h1%3A136986
- Tags: area:oss domain:oss impact:data-leak kind:bounty platform:hackerone sev:medium tech:linux technique:source-review vuln:crypto vuln:info-disclosure

**Target:** OpenSSL AES-NI CBC MAC/padding check in TLS CBC ciphersuites
**Root cause:** The constant-time padding check introduced to fix Lucky 13 (CVE-2013-0169) read and compared fixed bytes against MAC or padding but failed to verify there was enough data for both MAC and padding, leaking a padding oracle.
**Steps:**
1. Establish a TLS connection using an AES-CBC cipher against a server supporting AES-NI.
2. Act as MITM and send crafted ciphertexts to the server.
3. Observe the distinct response/timing when the MAC-and-padding length check fails versus a padding failure.
4. Use the oracle to iteratively recover plaintext bytes.
**How found:** Juraj Somorovsky used TLS-Attacker to probe the rewritten constant-time padding check and noticed the missing length validation for MAC plus padding bytes.
**Exploitation:** A MITM attacker positioned on the connection uses the padding oracle to decrypt captured TLS traffic when AES-CBC ciphers and AES-NI are in use.
**Insight:** When a constant-time rewrite of a MAC/padding check is done to fix a timing oracle, verify it still validates buffer length before comparing fixed-size regions; the length check itself can reintroduce an oracle.