CVE-2020-10941: Arm Mbed TLS before 2.16.5 allows attackers to obtain sensitive information (an RSA private key) by measuring cache usage during an import

Medium severity · published Mar 24, 2020

CVE-2020-10941

Arm Mbed TLS before 2.16.5 allows attackers to obtain sensitive information (an RSA private key) by measuring cache usage during an import

5.9

CVSS

1.7%

EPSS

On KEV

Description

Arm Mbed TLS before 2.16.5 allows attackers to obtain sensitive information (an RSA private key) by measuring cache usage during an import.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vector

Network

Complexity

High

Privileges

None

User interaction

None

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.7% · higher than 77% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Debian Linux · Debian

10.0 · source: NVD

Fedora · Fedoraproject

31; 32 · source: NVD

Mbed Crypto · Arm

before 3.1.0 · source: NVD

Mbed Tls · Arm

before 2.16.5 · source: NVD

Affected product

Mbed Crypto

Arm

All Mbed Crypto CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2020-10941

CVE.org

https://www.cve.org/CVERecord?id=CVE-2020-10941

Mailing List

https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5JPE2HFBDJF3UBT6Q4VWLKNKCVCMX25J/

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WD6OSOLLAR2AVPJAMGUKWRXN6477IHHV/

Vendor Advisory

https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-02