#VU29653 Use of a broken or risky cryptographic algorithm in mbed TLS - CVE-2020-10932

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU29653

#VU29653 Use of a broken or risky cryptographic algorithm in mbed TLS - CVE-2020-10932

Published: July 12, 2020


Vulnerability identifier: #VU29653
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2020-10932
CWE-ID: CWE-327
Exploitation vector: Local access
Exploit availability: No public exploit available
Vulnerable software:
mbed TLS
Software vendor:
ARM

Description

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to incorrect implementation of modular inverse operation as implemented in Mbed TLS. An attacker with access to precise enough timing and memory access information (typically an untrusted operating system attacking a secure enclave such as SGX or the TrustZone secure world) can fully recover an ECDSA private key after observing a number of signature operations a.k.k. single-trace side channel attack.


Remediation

Install updates from vendor's website.

External links