ARM mbed TLS up to 2.16.5/2.7.14 ECDSA Private Key risky encryption

Summaryinfo

A vulnerability, which was classified as problematic, was found in ARM mbed TLS up to 2.16.5/2.7.14. The affected element is an unknown function of the component ECDSA Private Key Handler. Such manipulation leads to risky encryption. This vulnerability is traded as CVE-2020-10932. An attack has to be approached locally. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in ARM mbed TLS up to 2.16.5/2.7.14. It has been rated as problematic. Affected by this issue is some unknown functionality of the component ECDSA Private Key Handler. The manipulation with an unknown input leads to a risky encryption vulnerability. Using CWE to declare the problem leads to CWE-327. The product uses a broken or risky cryptographic algorithm or protocol. Impacted is confidentiality. CVE summarizes:

An issue was discovered in Arm Mbed TLS before 2.16.6 and 2.7.x before 2.7.15. An attacker that can get precise enough side-channel measurements can recover the long-term ECDSA private key by (1) reconstructing the projective coordinate of the result of scalar multiplication by exploiting side channels in the conversion to affine coordinates; (2) using an attack described by Naccache, Smart, and Stern in 2003 to recover a few bits of the ephemeral scalar from those projective coordinates via several measurements; and (3) using a lattice attack to get from there to the long-term ECDSA private key used for the signatures. Typically an attacker would have sufficient access when attacking an SGX enclave and controlling the untrusted OS.

The weakness was shared 04/15/2020 (Website). The advisory is shared for download at tls.mbed.org. This vulnerability is handled as CVE-2020-10932 since 03/24/2020. The exploitation is known to be difficult. The attack needs to be approached locally. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1600.

Upgrading to version 2.16.6 or 2.7.15 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• ARM mbed TLS

Version

• 2.7.0
• 2.7.1
• 2.7.2
• 2.7.3
• 2.7.4
• 2.7.5
• 2.7.6
• 2.7.7
• 2.7.8
• 2.7.9
• 2.7.10
• 2.7.11
• 2.7.12
• 2.7.13
• 2.7.14
• 2.16.0
• 2.16.1
• 2.16.2
• 2.16.3
• 2.16.4
• 2.16.5

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion