Local side channel attack in mbed TLS - #VU54627
Published: July 8, 2021
Vulnerability identifier: #VU54627
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-208
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to observable timing discrepancy. An attacker with access to precise enough timing and memory access information (typically an untrusted operating system attacking a secure enclave such as SGX or the TrustZone secure world) can recover the private keys used in RSA.
Affected software
mbed TLS
Remediation
Install updates from vendor's website.
mbed TLS - addressed in versions 2.16.11, 2.27.0