CVE-2020-36422

Name of the Vulnerable Software and Affected Versions Arm Mbed TLS versions prior to 2.23.0

Description A side channel issue allows the recovery of an ECC private key. This is related to functions such as mbedtls ecp check pub priv, mbedtls pk parse key, mbedtls pk parse keyfile, mbedtls ecp mul, and mbedtls ecp mul restartable. The issue can be exploited by a remote attacker to gain access to confidential data.

Recommendations For versions prior to 2.23.0, update to version 2.23.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the functions mbedtls ecp check pub priv, mbedtls pk parse key, mbedtls pk parse keyfile, mbedtls ecp mul, and mbedtls ecp mul restartable to minimize the risk of exploitation.