CVE-2022-46392
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. An adversary with access to precise enough information about memory accesses (typically, an untrusted operating system attacking a secure enclave) can recover an RSA private key after observing the victim performing a single private-key operation, if the window size (MBEDTLS_MPI_WINDOW_SIZE) used for the exponentiation is 3 or smaller.
Se descubrió un problema en Mbed TLS anterior a 2.28.2 y 3.x anterior a 3.3.0. Un adversario con acceso a información suficientemente precisa sobre los accesos a la memoria (normalmente, un sistema operativo no confiable que ataca un enclave seguro) puede recuperar una clave privada RSA después de observar a la víctima realizando una única operación con clave privada, si el tamaño de la ventana (MBEDTLS_MPI_WINDOW_SIZE) utilizada para la exponenciación es 3 o menor.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-12-04 CVE Reserved
- 2022-12-15 CVE Published
- 2024-07-07 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-203: Observable Discrepancy
CAPEC
References (4)
URL | Tag | Source |
---|---|---|
https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.2 | Release Notes | |
https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.3.0 | Release Notes |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Arm Search vendor "Arm" | Mbed Tls Search vendor "Arm" for product "Mbed Tls" | < 2.28.2 Search vendor "Arm" for product "Mbed Tls" and version " < 2.28.2" | - |
Affected
| ||||||
Arm Search vendor "Arm" | Mbed Tls Search vendor "Arm" for product "Mbed Tls" | >= 3.0.0 < 3.3.0 Search vendor "Arm" for product "Mbed Tls" and version " >= 3.0.0 < 3.3.0" | - |
Affected
| ||||||
Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 36 Search vendor "Fedoraproject" for product "Fedora" and version "36" | - |
Affected
| ||||||
Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 37 Search vendor "Fedoraproject" for product "Fedora" and version "37" | - |
Affected
|