SB2018062008 - Information disclosure in libtomcrypt
Published: June 20, 2018
Security Bulletin ID
SB2018062008
Severity
Low
Patch available
NO
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Information disclosure (CVE-ID: CVE-2018-12437)
The vulnerability allows a local attacker to obtain potentially sensitive information.
The vulnerability exists in the libtomcrypt library due to a leakage of information through memory caches when the library uses a private key to create Elliptic Curve Digital Signature Algorithm (ECDSA) signatures. A local attacker can conduct a memory-cache side-channel attack and recover sensitive information, such ECDSA private keys, which could be used to conduct further attacks.
Remediation
Cybersecurity Help is not aware of any official remediation provided by the vendor.