ID CVE-2018-0497
Summary ARM mbed TLS before 2.12.0, before 2.7.5, and before 2.1.14 allows remote attackers to achieve partial plaintext recovery (for a CBC based ciphersuite) via a timing-based side-channel attack. This vulnerability exists because of an incorrect fix (with a wrong SHA-384 calculation) for CVE-2013-0169.
References
Vulnerable Configurations
  • ARM mbed TLS 1.3.0
    cpe:2.3:a:arm:mbed_tls:1.3.0
  • ARM mbed TLS 1.3.1
    cpe:2.3:a:arm:mbed_tls:1.3.1
  • ARM mbed TLS 1.3.2
    cpe:2.3:a:arm:mbed_tls:1.3.2
  • ARM mbed TLS 1.3.3
    cpe:2.3:a:arm:mbed_tls:1.3.3
  • ARM mbed TLS 1.3.4
    cpe:2.3:a:arm:mbed_tls:1.3.4
  • ARM mbed TLS 1.3.5
    cpe:2.3:a:arm:mbed_tls:1.3.5
  • ARM mbed TLS 1.3.6
    cpe:2.3:a:arm:mbed_tls:1.3.6
  • ARM mbed TLS 1.3.7
    cpe:2.3:a:arm:mbed_tls:1.3.7
  • ARM mbed TLS 1.3.8
    cpe:2.3:a:arm:mbed_tls:1.3.8
  • ARM mbed TLS 1.3.9
    cpe:2.3:a:arm:mbed_tls:1.3.9
  • ARM mbed TLS 1.3.10
    cpe:2.3:a:arm:mbed_tls:1.3.10
  • ARM mbed TLS 1.3.11
    cpe:2.3:a:arm:mbed_tls:1.3.11
  • ARM mbed TLS 1.3.12
    cpe:2.3:a:arm:mbed_tls:1.3.12
  • ARM mbed TLS 1.3.13
    cpe:2.3:a:arm:mbed_tls:1.3.13
  • ARM mbed TLS 1.3.14
    cpe:2.3:a:arm:mbed_tls:1.3.14
  • ARM mbed TLS 1.3.15
    cpe:2.3:a:arm:mbed_tls:1.3.15
  • ARM mbed TLS 1.3.16
    cpe:2.3:a:arm:mbed_tls:1.3.16
  • ARM mbed TLS 1.3.17
    cpe:2.3:a:arm:mbed_tls:1.3.17
  • ARM mbed TLS 1.3.18
    cpe:2.3:a:arm:mbed_tls:1.3.18
  • ARM mbed TLS 1.3.19
    cpe:2.3:a:arm:mbed_tls:1.3.19
  • ARM mbed TLS 1.3.19 Release Candidate 1
    cpe:2.3:a:arm:mbed_tls:1.3.19:rc1
  • ARM mbed TLS 1.3.20
    cpe:2.3:a:arm:mbed_tls:1.3.20
  • ARM mbed TLS 1.3.21
    cpe:2.3:a:arm:mbed_tls:1.3.21
  • ARM mbed TLS 1.3.21 Release Candidate 1
    cpe:2.3:a:arm:mbed_tls:1.3.21:rc1
  • ARM mbed TLS 1.3.22
    cpe:2.3:a:arm:mbed_tls:1.3.22
  • ARM mbed TLS 1.3.22 Release Candidate 1
    cpe:2.3:a:arm:mbed_tls:1.3.22:rc1
  • ARM mbed TLS 2.0.0
    cpe:2.3:a:arm:mbed_tls:2.0.0
  • ARM mbed TLS 2.1.0
    cpe:2.3:a:arm:mbed_tls:2.1.0
  • ARM mbed TLS 2.1.1
    cpe:2.3:a:arm:mbed_tls:2.1.1
  • ARM mbed TLS 2.1.2
    cpe:2.3:a:arm:mbed_tls:2.1.2
  • ARM mbed TLS 2.1.3
    cpe:2.3:a:arm:mbed_tls:2.1.3
  • ARM mbed TLS 2.1.4
    cpe:2.3:a:arm:mbed_tls:2.1.4
  • ARM mbed TLS 2.1.5
    cpe:2.3:a:arm:mbed_tls:2.1.5
  • ARM mbed TLS 2.1.6
    cpe:2.3:a:arm:mbed_tls:2.1.6
  • ARM mbed TLS 2.1.7
    cpe:2.3:a:arm:mbed_tls:2.1.7
  • ARM mbed TLS 2.1.7 Release Candidate 1
    cpe:2.3:a:arm:mbed_tls:2.1.7:rc1
  • ARM mbed TLS 2.1.8
    cpe:2.3:a:arm:mbed_tls:2.1.8
  • ARM mbed TLS 2.1.9
    cpe:2.3:a:arm:mbed_tls:2.1.9
  • ARM mbed TLS 2.1.9 Release Candidate 1
    cpe:2.3:a:arm:mbed_tls:2.1.9:rc1
  • ARM mbed TLS 2.1.10
    cpe:2.3:a:arm:mbed_tls:2.1.10
  • ARM mbed TLS 2.1.10 Release Candidate 1
    cpe:2.3:a:arm:mbed_tls:2.1.10:rc1
  • ARM mbed TLS 2.1.11
    cpe:2.3:a:arm:mbed_tls:2.1.11
  • ARM mbed TLS 2.1.11 Release Candidate 1
    cpe:2.3:a:arm:mbed_tls:2.1.11:rc1
  • ARM mbed TLS 2.1.12
    cpe:2.3:a:arm:mbed_tls:2.1.12
  • ARM mbed TLS 2.1.13
    cpe:2.3:a:arm:mbed_tls:2.1.13
  • ARM mbed TLS 2.2.0
    cpe:2.3:a:arm:mbed_tls:2.2.0
  • ARM mbed TLS 2.2.1
    cpe:2.3:a:arm:mbed_tls:2.2.1
  • ARM mbed TLS 2.2.2
    cpe:2.3:a:arm:mbed_tls:2.2.2
  • ARM mbed TLS 2.2.3
    cpe:2.3:a:arm:mbed_tls:2.2.3
  • ARM mbed TLS 2.3.0
    cpe:2.3:a:arm:mbed_tls:2.3.0
  • ARM mbed TLS 2.3.1
    cpe:2.3:a:arm:mbed_tls:2.3.1
  • ARM mbed TLS 2.3.2
    cpe:2.3:a:arm:mbed_tls:2.3.2
  • ARM mbed TLS 2.4.0
    cpe:2.3:a:arm:mbed_tls:2.4.0
  • ARM mbed TLS 2.4.1
    cpe:2.3:a:arm:mbed_tls:2.4.1
  • ARM mbed TLS 2.4.2
    cpe:2.3:a:arm:mbed_tls:2.4.2
  • ARM mbed TLS 2.4.2 Release Candidate 1
    cpe:2.3:a:arm:mbed_tls:2.4.2:rc1
  • ARM mbed TLS 2.5.0
    cpe:2.3:a:arm:mbed_tls:2.5.0
  • ARM mbed TLS 2.5.0 Release Candidate 1
    cpe:2.3:a:arm:mbed_tls:2.5.0:rc1
  • ARM mbed TLS 2.5.1
    cpe:2.3:a:arm:mbed_tls:2.5.1
  • ARM mbed TLS 2.6.0
    cpe:2.3:a:arm:mbed_tls:2.6.0
  • ARM mbed TLS 2.6.0 Release Candidate 1
    cpe:2.3:a:arm:mbed_tls:2.6.0:rc1
  • ARM mbed TLS 2.6.1
    cpe:2.3:a:arm:mbed_tls:2.6.1
  • ARM mbed TLS 2.6.1 Release Candidate 1
    cpe:2.3:a:arm:mbed_tls:2.6.1:rc1
  • ARM mbed TLS 2.7.0
    cpe:2.3:a:arm:mbed_tls:2.7.0
  • ARM mbed TLS 2.7.0 Release Candidate 1
    cpe:2.3:a:arm:mbed_tls:2.7.0:rc1
  • ARM mbed TLS 2.7.1
    cpe:2.3:a:arm:mbed_tls:2.7.1
  • ARM mbed TLS 2.7.2
    cpe:2.3:a:arm:mbed_tls:2.7.2
  • ARM mbed TLS 2.7.2 Release Candidate 1
    cpe:2.3:a:arm:mbed_tls:2.7.2:rc1
  • ARM mbed TLS 2.7.3
    cpe:2.3:a:arm:mbed_tls:2.7.3
  • ARM mbed TLS 2.7.4
    cpe:2.3:a:arm:mbed_tls:2.7.4
  • ARM mbed TLS 2.8.0
    cpe:2.3:a:arm:mbed_tls:2.8.0
  • ARM mbed TLS 2.8.0 Release Candidate 1
    cpe:2.3:a:arm:mbed_tls:2.8.0:rc1
  • ARM mbed TLS 2.9.0
    cpe:2.3:a:arm:mbed_tls:2.9.0
  • ARM mbed TLS 2.10.0
    cpe:2.3:a:arm:mbed_tls:2.10.0
  • ARM mbed TLS 2.11.0
    cpe:2.3:a:arm:mbed_tls:2.11.0
  • Debian Linux 8.0 (Jessie)
    cpe:2.3:o:debian:debian_linux:8.0
  • Debian Linux 9.0
    cpe:2.3:o:debian:debian_linux:9.0
CVSS
Base: 4.3
Impact:
Exploitability:
CWE CWE-310
CAPEC
  • Signature Spoofing by Key Recreation
    An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
nessus via4
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2018-C6B5117772.NASL
    description - Update to 2.13.0 - CVE-2018-0497 Release notes: https://tls.mbed.org/tech-updates/releases/mbedtls-2.13.0-2.7.6-and-2. 1.15-released Security Advisory: https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security -advisory-2018-02 ---- Make package installable again by fixing Requires. ---- New upstream release. ---- Make package installable again by fixing Requires. ---- New upstream release. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2019-01-03
    plugin id 120776
    published 2019-01-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=120776
    title Fedora 29 : dislocker / dolphin-emu / julia / mbedtls / nekovm / nng (2018-c6b5117772)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DLA-1518.NASL
    description Two vulnerabilities were discovered in polarssl, a lightweight crypto and SSL/TLS library (nowadays continued under the name mbedtls) which could result in plain text recovery via side-channel attacks. Two other minor vulnerabilities were discovered in polarssl which could result in arithmetic overflow errors. CVE-2018-0497 As a protection against the Lucky Thirteen attack, the TLS code for CBC decryption in encrypt-then-MAC mode performs extra MAC calculations to compensate for variations in message size due to padding. The amount of extra MAC calculation to perform was based on the assumption that the bulk of the time is spent in processing 64-byte blocks, which is correct for most supported hashes but not for SHA-384. Correct the amount of extra work for SHA-384 (and SHA-512 which is currently not used in TLS, and MD2 although no one should care about that). This is a regression fix for what CVE-2013-0169 had been fixed this. CVE-2018-0498 The basis for the Lucky 13 family of attacks is for an attacker to be able to distinguish between (long) valid TLS-CBC padding and invalid TLS-CBC padding. Since our code sets padlen = 0 for invalid padding, the length of the input to the HMAC function gives information about that. Information about this length (modulo the MD/SHA block size) can be deduced from how much MD/SHA padding (this is distinct from TLS-CBC padding) is used. If MD/SHA padding is read from a (static) buffer, a local attacker could get information about how much is used via a cache attack targeting that buffer. Let's get rid of this buffer. Now the only buffer used is the internal MD/SHA one, which is always read fully by the process() function. CVE-2018-9988 Prevent arithmetic overflow on bounds check and add bound check before signature length read in ssl_parse_server_key_exchange(). CVE-2018-9989 Prevent arithmetic overflow on bounds check and add bound check before length read in ssl_parse_server_psk_hint() For Debian 8 'Jessie', these problems have been fixed in version 1.3.9-2.1+deb8u4. We recommend that you upgrade your polarssl packages. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-09-27
    plugin id 117711
    published 2018-09-27
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=117711
    title Debian DLA-1518-1 : polarssl security update
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2018-5D6E80AB82.NASL
    description - Update to 2.13.0 - CVE-2018-0497 Release notes: https://tls.mbed.org/tech-updates/releases/mbedtls-2.13.0-2.7.6-and-2. 1.15-released Security Advisory: https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security -advisory-2018-02 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2019-01-03
    plugin id 120456
    published 2019-01-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=120456
    title Fedora 28 : dislocker / dolphin-emu / mbedtls / nekovm (2018-5d6e80ab82)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-4296.NASL
    description Two vulnerabilities were discovered in mbedtls, a lightweight crypto and SSL/TLS library which could result in plain text recovery via side-channel attacks.
    last seen 2019-02-21
    modified 2018-11-13
    plugin id 117506
    published 2018-09-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=117506
    title Debian DSA-4296-1 : mbedtls - security update
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_F4876DD49CA811E8AA170011D823EEBD.NASL
    description Simon Butcher reports : - When using a CBC based ciphersuite, a remote attacker can partially recover the plaintext. - When using a CBC based ciphersuite, an attacker with the ability to execute arbitrary code on the machine under attack can partially recover the plaintext by use of cache based side-channels.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 111659
    published 2018-08-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=111659
    title FreeBSD : mbed TLS -- plaintext recovery vulnerabilities (f4876dd4-9ca8-11e8-aa17-0011d823eebd)
refmap via4
confirm https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-02
debian DSA-4296
mlist [debian-lts-announce] 20180925 [SECURITY] [DLA 1518-1] polarssl security update
Last major update 28-07-2018 - 13:29
Published 28-07-2018 - 13:29
Last modified 28-09-2018 - 14:22
Back to Top