CVE-2024-23170

MEDIUM Year: 2024
CVSS v3 Score
5.5
Medium
Weakness Type
CWE-203
View all →

Vulnerability Description

An issue was discovered in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2. There was a timing side channel in RSA private operations. This side channel could be sufficient for a local attacker to recover the plaintext. It requires the attacker to send a large number of messages for decryption, as described in "Everlasting ROBOT: the Marvin Attack" by Hubert Kario.

Related Vulnerabilities

CVE-2016-2178

MEDIUM
CVSS:5.5(Medium)

The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA pri...

CWE-2032016

CVE-2018-3639

MEDIUM
CVSS:5.5(Medium)

Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of in...

CWE-2032018

CVE-2019-10483

MEDIUM
CVSS:5.5(Medium)

Side channel issue in QTEE due to usage of non-time-constant comparison function such as memcmp or strcmp in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electroni...

CWE-2032019

CVE-2019-14007

MEDIUM
CVSS:5.5(Medium)

Due to the use of non-time-constant comparison functions there is issue in timing side channels which can be used as a potential side channel for SUI corruption in Snapdragon Auto, Snapdragon Compute,...

CWE-2032019

CVE-2019-14067

MEDIUM
CVSS:5.5(Medium)

Using non-time-constant functions like memcmp to compare sensitive data can lead to information leakage through timing side channel issue. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivi...

CWE-2032019

CVE-2019-19338

MEDIUM
CVSS:5.5(Medium)

A flaw was found in the fix for CVE-2019-11135, in the Linux upstream kernel versions before 5.5 where, the way Intel CPUs handle speculative execution of instructions when a TSX Asynchronous Abort (T...

CWE-2032019