Vulnerabilities > CVE-2024-23170 - Information Exposure Through Discrepancy vulnerability in ARM Mbed TLS

CVSS 5.5 - MEDIUM

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

local

low complexity

arm

CWE-203

NVD

Published: 2024-01-31

Updated: 2024-02-22

Summary

An issue was discovered in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2. There was a timing side channel in RSA private operations. This side channel could be sufficient for a local attacker to recover the plaintext. It requires the attacker to send a large number of messages for decryption, as described in "Everlasting ROBOT: the Marvin Attack" by Hubert Kario.

Vulnerable Configurations

Part	Description	Count
Application	Arm ARM Mbed TLS 3.0.0 ARM Mbed TLS 3.1.0 ARM Mbed TLS 3.2.0 ARM Mbed TLS 3.3.0 ARM Mbed TLS 3.5.0 ARM Mbed TLS 3.5.1 ARM Mbed TLS 2.0.0 ARM Mbed TLS 2.1.0 ARM Mbed TLS 2.1.1 ARM Mbed TLS 2.1.2 ARM Mbed TLS 2.1.3 ARM Mbed TLS 2.1.4 ARM Mbed TLS 2.1.5 ARM Mbed TLS 2.1.6 ARM Mbed TLS 2.1.7 ARM Mbed TLS 2.1.8 ARM Mbed TLS 2.1.9 ARM Mbed TLS 2.1.10 ARM Mbed TLS 2.1.11 ARM Mbed TLS 2.1.12 ARM Mbed TLS 2.1.13 ARM Mbed TLS 2.1.14 ARM Mbed TLS 2.1.15 ARM Mbed TLS 2.1.16 ARM Mbed TLS 2.1.17 ARM Mbed TLS 2.1.18 ARM Mbed TLS 2.2.0 ARM Mbed TLS 2.2.1 ARM Mbed TLS 2.2.2 ARM Mbed TLS 2.2.3 ARM Mbed TLS 2.3.0 ARM Mbed TLS 2.3.1 ARM Mbed TLS 2.3.2 ARM Mbed TLS 2.4.0 ARM Mbed TLS 2.4.1 ARM Mbed TLS 2.4.2 ARM Mbed TLS 2.5.0 ARM Mbed TLS 2.5.1 ARM Mbed TLS 2.6.0 ARM Mbed TLS 2.6.1 ARM Mbed TLS 2.7.0 ARM Mbed TLS 2.7.1 ARM Mbed TLS 2.7.2 ARM Mbed TLS 2.7.3 ARM Mbed TLS 2.7.4 ARM Mbed TLS 2.7.5 ARM Mbed TLS 2.7.6 ARM Mbed TLS 2.7.7 ARM Mbed TLS 2.7.8 ARM Mbed TLS 2.7.9 ARM Mbed TLS 2.7.10 ARM Mbed TLS 2.7.11 ARM Mbed TLS 2.7.12 ARM Mbed TLS 2.7.13 ARM Mbed TLS 2.7.14 ARM Mbed TLS 2.7.15 ARM Mbed TLS 2.7.16 ARM Mbed TLS 2.7.17 ARM Mbed TLS 2.7.18 ARM Mbed TLS 2.8.0 ARM Mbed TLS 2.9.0 ARM Mbed TLS 2.10.0 ARM Mbed TLS 2.11.0 ARM Mbed TLS 2.12.0 ARM Mbed TLS 2.13.0 ARM Mbed TLS 2.13.1 ARM Mbed TLS 2.14.0 ARM Mbed TLS 2.14.1 ARM Mbed TLS 2.15.0 ARM Mbed TLS 2.15.1 ARM Mbed TLS 2.16.0 ARM Mbed TLS 2.16.1 ARM Mbed TLS 2.16.2 ARM Mbed TLS 2.16.3 ARM Mbed TLS 2.16.4 ARM Mbed TLS 2.16.5 ARM Mbed TLS 2.16.6 ARM Mbed TLS 2.16.7 ARM Mbed TLS 2.16.8 ARM Mbed TLS 2.16.9 ARM Mbed TLS 2.16.10 ARM Mbed TLS 2.16.11 ARM Mbed TLS 2.16.12 ARM Mbed TLS 2.17.0 ARM Mbed TLS 2.18.0 ARM Mbed TLS 2.18.1 ARM Mbed TLS 2.19.0 ARM Mbed TLS 2.19.1 ARM Mbed TLS 2.20.0 ARM Mbed TLS 2.21.0 ARM Mbed TLS 2.22.0 ARM Mbed TLS 2.23.0 ARM Mbed TLS 2.24.0 ARM Mbed TLS 2.25.0 ARM Mbed TLS 2.26.0 ARM Mbed TLS 2.27.0 ARM Mbed TLS 2.28.0 ARM Mbed TLS 2.28.1 ARM Mbed TLS 2.28.2 ARM Mbed TLS 2.28.5 ARM Mbed TLS 2.28.6	130

Common Weakness Enumeration (CWE)

CWE-203 - Information Exposure Through Discrepancy

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References