CVE-2024-23170

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-23170
An issue was discovered in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2. There was a timing side channel in RSA private operations. This side channel could be sufficient for a local attacker to recover the plaintext. It requires the attacker to send a large number of messages for decryption, as described in "Everlasting ROBOT: the Marvin Attack" by Hubert Kario.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GP5UU7Z6LJNBLBT4SC5WWS2HDNMTFZH5/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IIBPEYSVRK4IFLBSYJAWKH33YBNH5HR2/
https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-01-1/ Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*
cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*
History

22 Feb 2024, 03:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GP5UU7Z6LJNBLBT4SC5WWS2HDNMTFZH5/ -

17 Feb 2024, 02:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IIBPEYSVRK4IFLBSYJAWKH33YBNH5HR2/ -

09 Feb 2024, 01:01

Type Values Removed Values Added
CWE CWE-203
References () https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-01-1/ - () https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-01-1/ - Vendor Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Arm mbed Tls
Arm
CPE cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*

31 Jan 2024, 14:05

Type Values Removed Values Added
Summary
  • (es) Se descubrió un problema en Mbed TLS 2.x anterior a 2.28.7 y 3.x anterior a 3.5.2. Había un canal lateral de sincronización en las operaciones privadas de RSA. Este canal lateral podría ser suficiente para que un atacante local recupere el texto plano. Requiere que el atacante envíe una gran cantidad de mensajes para descifrarlos, como se describe en "Everlasting ROBOT: the Marvin Attack" de Hubert Kario.

31 Jan 2024, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-31 08:15

Updated : 2024-02-22 03:15

NVD link : CVE-2024-23170

Mitre link : CVE-2024-23170

CVE.ORG link : CVE-2024-23170

JSON object : View

Products Affected

arm

  • mbed_tls
CWE
CWE-203

Observable Discrepancy