PT-2020-6633 · Arm+2 · Mbed Tls+2
Hyesoon Kim
+6
·
Published
2020-06-20
·
Updated
2023-01-11
·
CVE-2020-36422
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Arm Mbed TLS versions prior to 2.23.0
Description
A side channel issue allows the recovery of an ECC private key. This is related to functions such as
mbedtls ecp check pub priv, mbedtls pk parse key, mbedtls pk parse keyfile, mbedtls ecp mul, and mbedtls ecp mul restartable. The issue can be exploited by a remote attacker to gain access to confidential data.Recommendations
For versions prior to 2.23.0, update to version 2.23.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the functions
mbedtls ecp check pub priv, mbedtls pk parse key, mbedtls pk parse keyfile, mbedtls ecp mul, and mbedtls ecp mul restartable to minimize the risk of exploitation.Fix
Side Channel Attack
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Mbed Tls