Information disclosure in libtomcrypt - CVE-2018-12437
Published: June 20, 2018 / Updated: June 20, 2018
Vulnerability identifier: #VU13399
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-12437
CWE-ID: CWE-200
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local attacker to obtain potentially sensitive information.
The vulnerability exists in the libtomcrypt library due to a leakage of information through memory caches when the library uses a private key to create Elliptic Curve Digital Signature Algorithm (ECDSA) signatures. A local attacker can conduct a memory-cache side-channel attack and recover sensitive information, such ECDSA private keys, which could be used to conduct further attacks.
Affected software
libtomcrypt
Gentoo Linux
Fedora
libtomcrypt
Gentoo Linux
Fedora
libtomcrypt
How to mitigate CVE-2018-12437
Cybersecurity Help is currently unaware of any solutions addressing the vulnerability.
libtomcrypt - addressed in versions 1.18.2-1.fc27, 1.18.2-1.fc28