Lucene search

K
veracodeVeracode Vulnerability DatabaseVERACODE:45542
HistoryFeb 20, 2024 - 12:15 p.m.

Side Channel Attacks

2024-02-2012:15:49
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
10
libmbedtls
side-channel
plaintext recovery
local users
cbc ciphersuite
cryptographic operations
cache access patterns
software

CVSS2

1.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:M/Au:N/C:P/I:N/A:N

CVSS3

4.7

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.3

Confidence

Low

EPSS

0.001

Percentile

19.8%

libmbedtls.so is vulnerable to plain text recovery via side-channel attacks. The vulnerability is due to the ability of local users to achieve partial plaintext recovery for a CBC based ciphersuite via measuring the time it takes to perform certain cryptographic operations. An attacker can gather information about the plaintext data based on the cache access patterns.

CVSS2

1.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:M/Au:N/C:P/I:N/A:N

CVSS3

4.7

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.3

Confidence

Low

EPSS

0.001

Percentile

19.8%