CVE-2020-16150
First published: Wed Sep 02 2020(Updated: )
A Lucky 13 timing side channel in mbedtls_ssl_decrypt_buf in library/ssl_msg.c in Trusted Firmware Mbed TLS through 2.23.0 allows an attacker to recover secret key information. This affects CBC mode because of a computed time difference based on a padding length.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ARM mbed TLS | <2.7.17 | |
| ARM mbed TLS | >=2.8.0<2.16.8 | |
| ARM mbed TLS | >=2.17.0<2.24.0 | |
| Fedoraproject Fedora | =31 | |
| Fedoraproject Fedora | =32 | |
| Fedoraproject Fedora | =33 | |
| Debian Debian Linux | =10.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5OSOFUD6UTGTDDSQRS62BPXDU52I6PUA/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IRPBHCQKZXHVKOP5O5EWE7P76AWGUXQJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OD3NM6GD73CTFFRBKG5G2ACXGG7QQHCC/
- https://tls.mbed.org/tech-updates/security-advisories
- https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-09-1
Frequently Asked Questions
What is CVE-2020-16150?
CVE-2020-16150 is a Lucky 13 timing side channel vulnerability in mbedtls_ssl_decrypt_buf in Trusted Firmware Mbed TLS through 2.23.0.
How does CVE-2020-16150 affect the ARM mbed TLS library?
CVE-2020-16150 affects the ARM mbed TLS library versions up to 2.7.17, between 2.8.0 and 2.16.8, and between 2.17.0 and 2.24.0.
What is the severity of CVE-2020-16150?
CVE-2020-16150 has a severity of 5.5 (medium).
How can an attacker exploit CVE-2020-16150?
An attacker can exploit CVE-2020-16150 to recover secret key information through a Lucky 13 timing side channel in CBC mode.
How can I mitigate CVE-2020-16150?
To mitigate CVE-2020-16150, update to a version of the ARM mbed TLS library above 2.24.0 or apply the necessary patches provided by the vendor.
- collector/nvd-index
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/type
- agent/description
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/arm
- canonical/arm mbed tls
- version/arm mbed tls/2.8.0
- version/arm mbed tls/2.17.0
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/31
- version/fedoraproject fedora/32
- version/fedoraproject fedora/33
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/10.0