SB2018062009 - Information disclosure in InsideSecure MatrixSSL
Published: June 20, 2018
Security Bulletin ID
SB2018062009
Severity
Low
Patch available
NO
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Information disclosure (CVE-ID: CVE-2018-12439)
The vulnerability allows a local attacker to obtain potentially sensitive information.
The vulnerability exists in the MatrixSSL library due to a leakage of information through memory caches when the library uses a private key to create Elliptic Curve Digital Signature Algorithm (ECDSA) signatures as demonstrayed in the dsa/dsa.cpp, ec_group/ec_group.cpp, and ecdsa/ecdsa.cpp source code files. A local attacker can conduct a memory-cache side-channel attack and recover sensitive information, such ECDSA private keys, which could be used to conduct further attacks.
Remediation
Cybersecurity Help is not aware of any official remediation provided by the vendor.