PT-2020-12433 · Arm+3 · Arm Mbed Tls+3

Published 2018-03-26 · Updated 2023-03-03 · CVE-2020-10932

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Arm Mbed TLS versions 2.16.6 and earlier Arm Mbed TLS versions 2.7.x through 2.7.14

Description An issue was discovered in Arm Mbed TLS where an attacker can recover the long-term ECDSA private key by exploiting side channels in the conversion to affine coordinates, using an attack described by Naccache, Smart, and Stern in 2003 to recover a few bits of the ephemeral scalar, and then using a lattice attack to get to the long-term ECDSA private key. This typically requires sufficient access, such as when attacking an SGX enclave and controlling the untrusted OS.

Recommendations For Arm Mbed TLS versions 2.16.6 and earlier, update to version 2.16.6 or later. For Arm Mbed TLS versions 2.7.x through 2.7.14, update to version 2.7.15 or later.

Fix

Side Channel Attack

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-203

CWE-327

Related Identifiers

ALT-PU-2018-1495

ALT-PU-2020-2107

ALT-PU-2020-2355

CVE-2020-10932

DLA-3249-1

MGASA-2020-0265

OPENSUSE-SU-2021:0384-1

OPENSUSE-SU-2021:0397-1

OPENSUSE-SU-2021_0384-1

Affected Products

Alt Linux

Arm Mbed Tls

Astra Linux

Suse

References · 26

• https://osv.dev/vulnerability/UBUNTU-CVE-2020-10932 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-10932 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2020-10932 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0397-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FCWN5HIF4CJ2LZTOMEBJ7Q4IMMV7ZU2V · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-10932 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNOS2IIBH5WNJXZUV546PY7666DE7Y3L · Vendor Advisory
• https://tls.mbed.org/tech-updates/security-advisories · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-10932 · Vendor Advisory
• https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-04 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-10932 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0265.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-10932 · Security Note
• https://ubuntu.com/security/CVE-2020-10932 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0384-1 · Vendor Advisory