Vulnerability · Published Dec 15, 2022 · Assigned by mitre
CVE-2022-46392
Medium 5.3
In plain English
A medium-severity security flaw in the mbedtls package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. An adversary with access to precise enough information about memory accesses (typically, an untrusted operating system attacking a secure enclave) can recover an RSA private key after observing the victim performing a single private-key operation, if the window size (MBEDTLS_MPI_WINDOW_SIZE) used for the exponentiation is 3 or smaller.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | mbedtls | 2.28.2-1 | DEBIAN-CVE-2022-46392 |
| Debian:13 | mbedtls | 2.28.2-1 | DEBIAN-CVE-2022-46392 |
| Debian:14 | mbedtls | 2.28.2-1 | DEBIAN-CVE-2022-46392 |
Affected products (as reported)
Weakness: CWE-203 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N