Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2021:0384-1

Опубликовано: 05 мар. 2021
Источник: suse-cvrf

Описание

Security update for mbedtls

This update for mbedtls fixes the following issues:

  • mbedtls was updated to version 2.16.9
    • CVE-2020-10932: Fixed side channel in ECC code that allowed an adversary with access to precise enough timing and memory access information (typically an untrusted operating system attacking a secure enclave) to fully recover an ECDSA private key (boo#1181468).

Список пакетов

openSUSE Leap 15.2
libmbedcrypto3-2.16.9-lp152.2.3.1
libmbedcrypto3-32bit-2.16.9-lp152.2.3.1
libmbedtls12-2.16.9-lp152.2.3.1
libmbedtls12-32bit-2.16.9-lp152.2.3.1
libmbedx509-0-2.16.9-lp152.2.3.1
libmbedx509-0-32bit-2.16.9-lp152.2.3.1
mbedtls-devel-2.16.9-lp152.2.3.1

Ссылки

Описание

An issue was discovered in Arm Mbed TLS before 2.16.6 and 2.7.x before 2.7.15. An attacker that can get precise enough side-channel measurements can recover the long-term ECDSA private key by (1) reconstructing the projective coordinate of the result of scalar multiplication by exploiting side channels in the conversion to affine coordinates; (2) using an attack described by Naccache, Smart, and Stern in 2003 to recover a few bits of the ephemeral scalar from those projective coordinates via several measurements; and (3) using a lattice attack to get from there to the long-term ECDSA private key used for the signatures. Typically an attacker would have sufficient access when attacking an SGX enclave and controlling the untrusted OS.

Затронутые продукты
openSUSE Leap 15.2:libmbedcrypto3-2.16.9-lp152.2.3.1
openSUSE Leap 15.2:libmbedcrypto3-32bit-2.16.9-lp152.2.3.1
openSUSE Leap 15.2:libmbedtls12-2.16.9-lp152.2.3.1
openSUSE Leap 15.2:libmbedtls12-32bit-2.16.9-lp152.2.3.1
Ссылки