Duplicate of b/80231449.
Assigning to rkolchmeyer@ (our current security oncall).

we're updating to 1.0.2o here:
  https://chromium-review.googlesource.com/1048867

but the fix is going to be in 1.0.2p which isn't yet released.  not sure we need to backport the patch by hand ?  just wait for the release ?

At least for Chrome OS proper, given that it's not trivial for attackers to gain native code execution (which I assume would be needed to perform reliably cache timing), this doesn't seem super severe. Malicious Android apps might be a vector, at least for targeted attacks? Still requires the user to install the malicious app.

Bottom line: IMHO waiting for 1.0.2p release is reasonable.

upgrading OpenSSL in CrOS wouldn't matter to Android as they ship their own stuff, and random apps also bundle their own code

native OpenSSL matters more to groups like COS for the reasons Mattias noted

Android could mount a cache timing attack against key generation taking place on the Chrome OS side though, so it is relevant as an attack vector.

Given that OpenSSL considers this to be low severity (https://www.openssl.org/news/secadv/20180416.txt), I think it should probably be ok to wait for the next OpenSSL release.

rkolchmeyer: Uh oh! This issue still open and hasn't been updated in the last 14 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

OpenSSL 1.0.2p has not yet been released (1.0.2 release notes can be seen here https://www.openssl.org/news/openssl-1.0.2-notes.html). Still waiting for 1.0.2p to be released.

rkolchmeyer: Uh oh! This issue still open and hasn't been updated in the last 14 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

1.0.2-p is still not released as of now.
For the current change log see: https://www.openssl.org/news/cl102.txt

Would it make sense to just backport the patch?

1.0.2p has been released. wonderfly@ is working on the update: b/80231449

Yes, https://crrev.com/c/1185894 in CQ.

Cool, feel free to close this once that lands.

Forgot to attach this bug on the CL, but it's been merged to head (m70). https://crrev.com/c/1185894

I am going to work on backporting it to M69, which as per COS' security policy is enough. Do you want it in M68 for CrOS?

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/overlays/chromiumos-overlay/+/a80cec4bb03a57e5de6be77635c3f41d748195e4

commit a80cec4bb03a57e5de6be77635c3f41d748195e4
Author: Daniel Wang <wonderfly@google.com>
Date: Thu Aug 30 03:28:22 2018

openssl: version bump to 1.0.2p

BUG=b:80231449,b:112454698, chromium:846296 
TEST=precq passes

Change-Id: Icbd612d53bfc983a7051ea499037ab139213b4b9
Reviewed-on: https://chromium-review.googlesource.com/1185894
Commit-Ready: Daniel Wang <wonderfly@google.com>
Tested-by: Daniel Wang <wonderfly@google.com>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
(cherry picked from commit cd4c4ae3baf80feb319b5307d114bcc673b61f3d)
Reviewed-on: https://chromium-review.googlesource.com/1196123
Commit-Queue: Daniel Wang <wonderfly@google.com>

[add] https://crrev.com/a80cec4bb03a57e5de6be77635c3f41d748195e4/dev-libs/openssl/openssl-1.0.2p-r1.ebuild
[rename] https://crrev.com/a80cec4bb03a57e5de6be77635c3f41d748195e4/dev-libs/openssl/openssl-1.0.2p.ebuild
[modify] https://crrev.com/a80cec4bb03a57e5de6be77635c3f41d748195e4/dev-libs/openssl/Manifest

Landed in M69. Let'll let Jorge decide whether this needs to go in M68.

I don't think infoleak needs to be patched beyond 69, given how close we're to 69.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot