CVE-2022-23001

When compressing or decompressing elliptic curve points using the Sweet B library, an incorrect choice of sign bit is used. An attacker with user level privileges and no other user's assistance can exploit this vulnerability with only knowledge of the public key and the library. The resulting output may cause an error when used in other operations; for instance, verification of a valid signature under a decompressed public key may fail. This may be leveraged by an attacker to cause an error scenario in applications which use the library, resulting in a limited denial of service for an individual user. The scope of impact cannot extend to other components.
Configurations

Configuration 1 (hide)

cpe:2.3:a:westerndigital:sweet_b:1:*:*:*:*:*:*:*

History

05 Aug 2022, 18:44

Type Values Removed Values Added
CWE CWE-682
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 5.3
References (MISC) https://www.westerndigital.com/support/product-security/wdc-22013-sweet-b-incorrect-output-vulnerabilities - (MISC) https://www.westerndigital.com/support/product-security/wdc-22013-sweet-b-incorrect-output-vulnerabilities - Product, Vendor Advisory
First Time Westerndigital
Westerndigital sweet B
CPE cpe:2.3:a:westerndigital:sweet_b:1:*:*:*:*:*:*:*

29 Jul 2022, 19:15

Type Values Removed Values Added
New CVE

Information

Published : 2022-07-29 19:15

Updated : 2023-12-10 14:35


NVD link : CVE-2022-23001

Mitre link : CVE-2022-23001

CVE.ORG link : CVE-2022-23001


JSON object : View

Products Affected

westerndigital

  • sweet_b
CWE
CWE-682

Incorrect Calculation