CVE-2021-24119 in Mbed TLS
Summary
by MITRE • 07/14/2021
In Trusted Firmware Mbed TLS 2.24.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single stepped, especially Intel SGX.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2025
The vulnerability identified as CVE-2021-24119 represents a significant side-channel weakness in the Mbed TLS cryptographic library version 2.24.0, specifically affecting the base64 PEM file decoding functionality. This flaw exposes sensitive cryptographic information through indirect timing channels that can be exploited by attackers with system-level privileges. The vulnerability is particularly concerning because it affects environments where software operates in isolated execution contexts, such as Intel Software Guard Extensions (SGX) enclaves, where traditional security boundaries may be weakened. The attack vector leverages controlled-channel and side-channel techniques that can be executed against software running in these isolated environments, making it a critical concern for systems relying on hardware-based isolation for security.
The technical implementation of this vulnerability stems from the base64 decoding routine within the PEM file processing component of Mbed TLS. When parsing PEM formatted files containing RSA keys, the library exhibits timing variations in memory access patterns and computational operations that correlate with the secret key material being processed. These timing discrepancies create observable side-channel information leakage that can be systematically analyzed and exploited. The vulnerability manifests during the decoding process where the library performs variable-time operations on key material, allowing an attacker to infer information about the secret RSA keys through careful measurement of execution timing differences. This type of vulnerability aligns with CWE-388, which specifically addresses side-channel weaknesses in cryptographic implementations, and represents a classic example of timing-based information leakage that violates fundamental security principles for cryptographic operations.
The operational impact of CVE-2021-24119 extends beyond simple information disclosure, as it can potentially enable full key recovery under certain conditions. Attackers with system-level access can leverage this vulnerability to extract RSA private key components, effectively compromising the entire cryptographic security posture of affected systems. The vulnerability is particularly dangerous in Intel SGX environments because these isolated execution contexts are specifically designed to protect against such attacks, yet this flaw demonstrates that even hardware-based isolation can be circumvented through sophisticated side-channel analysis. The attack requires only a controlled-channel environment where the attacker can monitor execution timing and potentially single-step the target software, making it feasible in laboratory conditions or environments where such monitoring capabilities exist. This represents a significant escalation from typical software vulnerabilities to a class of attacks that can undermine the fundamental security assumptions of modern cryptographic implementations.
Mitigation strategies for CVE-2021-24119 require immediate patching of affected Mbed TLS installations to version 2.24.1 or later, which contains the necessary fixes for the base64 decoding routine. Organizations should also implement additional protective measures including runtime monitoring for unusual timing patterns, code obfuscation techniques to mask timing variations, and enhanced isolation controls for cryptographic operations. The fix addresses the underlying timing inconsistencies in the PEM decoding process by implementing constant-time operations throughout the base64 decoding routine, eliminating the information leakage pathways that enabled the attack. Security teams should conduct comprehensive vulnerability assessments across all systems utilizing Mbed TLS, particularly those operating in isolated environments such as SGX enclaves, to identify and remediate any potential exposure. This vulnerability underscores the critical importance of side-channel resistance in cryptographic implementations and highlights the necessity of following established security frameworks such as those outlined in the NIST SP 800-57 guidelines for cryptographic key management and the ATT&CK framework's coverage of side-channel attacks under the technique T1005 for data from local system repositories.