Western Digital Sweet B Cryptographic Library Elliptic Curve calculation

Summaryinfo

A vulnerability, which was classified as problematic, was found in Western Digital Sweet B Cryptographic Library. This affects an unknown function of the component Elliptic Curve Handler. Executing a manipulation can lead to calculation. This vulnerability is tracked as CVE-2022-23001. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability has been found in Western Digital Sweet B Cryptographic Library (Software Library) (affected version not known) and classified as problematic. This vulnerability affects some unknown functionality of the component Elliptic Curve Handler. The manipulation with an unknown input leads to a calculation vulnerability. The CWE definition for the vulnerability is CWE-682. The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management. As an impact it is known to affect availability. CVE summarizes:

When compressing or decompressing elliptic curve points using the Sweet B library, an incorrect choice of sign bit is used. An attacker with user level privileges and no other user's assistance can exploit this vulnerability with only knowledge of the public key and the library. The resulting output may cause an error when used in other operations; for instance, verification of a valid signature under a decompressed public key may fail. This may be leveraged by an attacker to cause an error scenario in applications which use the library, resulting in a limited denial of service for an individual user. The scope of impact cannot extend to other components.

The weakness was disclosed 07/30/2022. The advisory is shared for download at westerndigital.com. This vulnerability was named CVE-2022-23001 since 01/10/2022. There are neither technical details nor an exploit publicly available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Software Library

Vendor

• Western Digital

Name

• Sweet B Cryptographic Library

License

• commercial

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion