Local side channel attack in mbed TLS - #VU54627
Published: July 8, 2021
Vulnerability identifier: #VU54627
CSH Severity: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: N/A
CWE-ID: CWE-208
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
mbed TLS
mbed TLS
Software vendor:
ARM
ARM
Description
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to observable timing discrepancy. An attacker with access to precise enough timing and memory access information (typically an untrusted operating system attacking a secure enclave such as SGX or the TrustZone secure world) can recover the private keys used in RSA.
Remediation
Install updates from vendor's website.