PT-2020-22794 · Arm · Mbed Tls

Published 2020-03-08 · Updated 2020-03-08

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions mbedtls (affected versions not specified)

Description The issue allows an adversary to launch a side channel attack to recover the RSA private key when it is being imported, if Mbed TLS is running in an SGX enclave and the adversary has control of the main operating system. Additionally, there is a potential memory overread when performing an ECDSA signature operation, which could result in information disclosure or denial of service, such as application crash or extra resource consumption.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

MGASA-2020-0130

Affected Products

Mbed Tls

References · 5

• https://advisories.mageia.org/MGASA-2020-0130.html · Security Note
• https://osv.dev/vulnerability/MGASA-2020-0130 · Vendor Advisory
• https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-02 · Note
• https://bugs.mageia.org/show_bug.cgi?id=26259 · Note
• https://tls.mbed.org/tech-updates/releases/mbedtls-2.16.5-and-2.7.14-released · Note