PT-2024-1658 · Mbed Tls+3 · Mbed Tls+3

Hubert Kario · Published 2024-01-10 · Updated 2026-05-05 · CVE-2024-23170

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mbed TLS versions 2.x before 2.28.7 Mbed TLS versions 3.x before 3.5.2

Description A timing side channel in RSA private operations could allow a local attacker to recover the plaintext by sending a large number of messages for decryption, as described in "Everlasting ROBOT: the Marvin Attack" by Hubert Kario. This side channel could be exploited by a remote attacker to gain access to confidential information.

Recommendations For Mbed TLS versions 2.x before 2.28.7, update to version 2.28.7 or later to resolve the issue. For Mbed TLS versions 3.x before 3.5.2, update to version 3.5.2 or later to resolve the issue. As a temporary workaround, consider restricting access to RSA private operations until a patch is available.

Fix

Information Disclosure

Side Channel Attack

Weakness Enumeration

CWE-385

CWE-200

CWE-208

CWE-203

Related Identifiers

ALT-PU-2024-15509

ALT-PU-2025-10462

AZL-47697

BDU:2024-01340

CVE-2024-23170

OPENSUSE-SU-2024:0037-1

OPENSUSE-SU-2024:13639-1

OPENSUSE-SU-2024:13640-1

Affected Products

Alt Linux

Astra Linux

Debian

Mbed Tls

References · 32

• https://nvd.nist.gov/vuln/detail/CVE-2024-23170 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GP5UU7Z6LJNBLBT4SC5WWS2HDNMTFZH5 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-23170 · Security Note
• https://bdu.fstec.ru/vul/2024-01340 · Security Note
• https://ubuntu.com/security/CVE-2024-23170 · Vendor Advisory
• https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-01-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-23170 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IIBPEYSVRK4IFLBSYJAWKH33YBNH5HR2 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2024-0905SE18MD · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-23170 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-23170 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-47697 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/IIBPEYSVRK4IFLBSYJAWKH33YBNH5HR2 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2024-23170 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13639-1 · Vendor Advisory