Medium severity · published Sep 3, 2024
CVE-2024-45678
Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware before 2.4.0 allow an ECDSA secret-key extraction attack (that requires physical…
4.2
CVSS
0.3%
EPSS
No
On KEV
Description
Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware before 2.4.0 allow an ECDSA secret-key extraction attack (that requires physical access and expensive equipment) in which an electromagnetic side channel is present because of a non-constant-time modular inversion for the Extended Euclidean Algorithm, aka the EUCLEAK issue. Other uses of an Infineon cryptographic library may also be affected.
CVSS vector
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Physical
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SK
Security Key C Nfc BY Yubico Firmware · Yubico
before 5.7 · source: NVD
SK
Security Key Nfc BY Yubico Firmware · Yubico
before 5.7 · source: NVD
Y2
Yubihsm 2 Fips Firmware · Yubico
before 2.4.0 · source: NVD
Y2
Yubihsm 2 Firmware · Yubico
before 2.4.0 · source: NVD
Y5
Yubikey 5 Nano Fips Firmware · Yubico
before 5.7 · source: NVD
Y5
Yubikey 5 Nano Firmware · Yubico
before 5.7 · source: NVD
Y5
Yubikey 5 Nfc Fips Firmware · Yubico
before 5.7 · source: NVD
Y5
Yubikey 5 Nfc Firmware · Yubico
before 5.7 · source: NVD
Y5
Yubikey 5c Fips Firmware · Yubico
before 5.7 · source: NVD
Y5
Yubikey 5c Firmware · Yubico
before 5.7 · source: NVD
Y5
Yubikey 5c Nano Fips Firmware · Yubico
before 5.7 · source: NVD
Y5
Yubikey 5c Nano Firmware · Yubico
before 5.7 · source: NVD
Affected product
SK
Security Key C Nfc BY Yubico Firmware
Yubico
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-45678
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-45678
Press/Media Coverage
https://arstechnica.com/security/2024/09/yubikeys-are-vulnerable-to-cloning-attacks-thanks-to-newly-discovered-side-channel/
Issue Tracking
https://news.ycombinator.com/item?id=41434500
Third Party Advisory
https://ninjalab.io/eucleak/
Technical Description
https://ninjalab.io/wp-content/uploads/2024/09/20240903_eucleak.pdf
Mitigation
https://support.yubico.com/hc/en-us/articles/15705749884444
Vendor Advisory
https://www.yubico.com/support/security-advisories/ysa-2024-03/