SB2021070825 - Local side channel attacks in Mbed TLS

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Local side channel attack (CVE-ID: N/A)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to observable timing discrepancy. An attacker with access to precise enough timing and memory access information (for example, able to execute arbitrary code and sharing a memory cache with the victim) can recover the private keys used in static Diffie-Hellman with x25519 and x448.

2) Local side channel attack (CVE-ID: N/A)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to observable timing discrepancy. An attacker with access to precise enough timing and memory access information (typically an untrusted operating system attacking a secure enclave such as SGX or the TrustZone secure world) can recover the private keys used in RSA.

Remediation

Install update from vendor's website.

References

• https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2021-07-2
• https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2021-07-1