CVE-2021-29415

EPSS 0.08%
Veröffentlicht 21.05.2021 12:15:07
Zuletzt bearbeitet 21.11.2024 06:01:03
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

The elliptic curve cryptography (ECC) hardware accelerator, part of the ARM® TrustZone® CryptoCell 310, contained in the NordicSemiconductor nRF52840 through 2021-03-29 has a non-constant time ECDSA implemenation. This allows an adversary to recover the private ECC key used during an ECDSA operation.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 6

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Nordicsemi ≫ Nrf52840 Firmware Version <= 2021-03-29

Nordicsemi ≫ Nrf52840 Version-

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.08%	0.244

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	5.5	1.8	3.6	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov	2.1	3.9	2.9	AV:L/AC:L/Au:N/C:P/I:N/A:N

CWE-203 Observable Discrepancy

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

https://eprint.iacr.org/2021/640

Third Party Advisory

https://www.aisec.fraunhofer.de/de/das-institut/wissenschaftliche-exzellenz/security-and-trust-in-open-source-security-tokens.html

Third Party Advisory

https://www.sit.fraunhofer.de/en/news-events/downloads-services/cve/

Not Applicable

https://nvd.nist.gov/vuln/detail/CVE-2021-29415

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2021-29415

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2021-29415

EUVD