Broken Cryptographic Algorithm in Mbed TLS by ARM

CVE-2021-36647

What is CVE-2021-36647?

The Mbed TLS library, specifically in the function mbedtls_mpi_exp_mod() within lignum.c, is affected by the use of a weak or broken cryptographic algorithm. This flaw enables malicious actors who possess sufficient timing and memory access insights to exploit untrusted systems targeting secure environments, such as SGX or TrustZone secure worlds, to recover sensitive RSA private keys. This vulnerability poses significant risks for systems relying on Mbed TLS for cryptographic operations and highlights the need for updates to mitigate potential exploitation.

References