Vulnerability · Published Aug 9, 2023 · Assigned by Halborn
CVE-2023-33242Lindell17 TSS Abort Mishandling
Critical 9.6
In plain English
A critical-severity security flaw in Wallet from Lindell TSS Implementations. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)9.6Critical
Exploit odds (30 days)1.5%top 25.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC
Official description
Crypto wallets implementing the Lindell17 TSS protocol might allow an attacker to extract the full ECDSA private key by exfiltrating a single bit in every signature attempt (256 in total) because of not adhering to the paper's security proof's assumption regarding handling aborts after a failed signature.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Lindell TSS Implementations | Wallet | 17 |