An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. An adversary with access to precise enough information about memory accesses (typically, an untrusted operating system attacking a secure enclave) can recover an RSA private key after observing the victim performing a single private-key operation, if the window size (MBEDTLS_MPI_WINDOW_SIZE) used for the exponentiation is 3 or smaller.
Metrics
Affected Vendors & Products
Advisories
| Source | ID | Title |
|---|---|---|
 Debian DLA |
DLA-4236-1 | mbedtls security update |
 EUVD |
EUVD-2022-49201 | An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. An adversary with access to precise enough information about memory accesses (typically, an untrusted operating system attacking a secure enclave) can recover an RSA private key after observing the victim performing a single private-key operation, if the window size (MBEDTLS_MPI_WINDOW_SIZE) used for the exponentiation is 3 or smaller. |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Mon, 21 Apr 2025 15:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: mitre
Published:
Updated: 2025-04-21T14:33:40.703Z
Reserved: 2022-12-04T00:00:00.000Z
Link: CVE-2022-46392
Vulnrichment
Updated: 2024-08-03T14:31:46.362Z
NVD
Status : Modified
Published: 2022-12-15T23:15:10.513
Modified: 2025-04-21T15:15:55.880
Link: CVE-2022-46392
Redhat
No data.
OpenCVE Enrichment
No data.