PT-2021-6586 · Arm+2 · Arm Mbed Tls+2

Kfyatek · Published 2020-09-02 · Updated 2025-08-21 · CVE-2020-36424

Positive Technologies (AI Summary)

CVSS v2.0

6.3

Medium

Base vector

AV:N/AC:M/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Arm Mbed TLS versions prior to 2.24.0

Description An issue in Arm Mbed TLS allows an attacker to recover a private key via a side-channel attack against generation of base blinding/unblinding values, potentially affecting RSA or static Diffie-Hellman. This could lead to unauthorized access to confidential data due to information disclosure through inconsistency in TLS and SSL protocol implementation.

Recommendations For Arm Mbed TLS versions prior to 2.24.0, update to version 2.24.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data and implementing additional security measures to minimize the risk of exploitation.

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

ALT-PU-2020-2711

ALT-PU-2021-2234

ALT-PU-2025-10462

BDU:2022-01852

CVE-2020-36424

DLA-3249-1

Affected Products

Alt Linux

Arm Mbed Tls

Astra Linux

References · 16

• https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-09-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-36424 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-36424 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-36424 · Vendor Advisory
• https://bugs.gentoo.org/740108 · Patch
• https://osv.dev/vulnerability/CVE-2020-36424 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-36424 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01852 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-36424 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-36424 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3249-1 · Vendor Advisory
• https://github.com/ARMmbed/mbedtls/releases/tag/v2.7.17 · Note
• https://github.com/ARMmbed/mbedtls/releases/tag/v2.24.0 · Note
• https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.8 · Note
• https://t.me/cvenotify/17851 · Telegram Post