LibTomCrypt through 1.18.1 allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.
References
Link | Resource |
---|---|
https://security.gentoo.org/glsa/202007-53 | Third Party Advisory |
https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/ | Exploit Technical Description Third Party Advisory |
Configurations
History
29 Jun 2021, 14:27
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:o:linaro:op-tee:*:*:*:*:*:*:*:* |
09 Mar 2021, 15:09
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:openbsd:libressl:-:*:*:*:*:*:*:* cpe:2.3:a:botan_project:botan:-:*:*:*:*:*:*:* cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:* cpe:2.3:a:wolfssl:wolfcrypt:-:*:*:*:*:*:*:* cpe:2.3:a:matrixssl:matrixssl:-:*:*:*:*:*:*:* cpe:2.3:a:cryptlib:cryptlib:-:*:*:*:*:*:*:* cpe:2.3:a:google:boringssl:-:*:*:*:*:*:*:* cpe:2.3:a:openssl:openssl:-:*:*:*:*:*:*:* cpe:2.3:a:libsunec_project:libsunec:-:*:*:*:*:*:*:* |
Information
Published : 2018-06-15 02:29
Updated : 2023-12-10 12:30
NVD link : CVE-2018-12437
Mitre link : CVE-2018-12437
CVE.ORG link : CVE-2018-12437
JSON object : View
Products Affected
linaro
- op-tee
libtom
- libtomcrypt
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor