CVE-2015-5738

moderate-risk
Published 2016-07-26

The RSA-CRT implementation in the Cavium Software Development Kit (SDK) 2.x, when used on OCTEON II CN6xxx Hardware on Linux to support TLS with Perfect Forward Secrecy (PFS), makes it easier for remote attackers to obtain private RSA keys by conducting a Lenstra side-channel attack.

Do I need to act?

-
0.81% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (2)

Software Development Kit

Affected Vendors

F5 Marvell

References (6)

Broken Link http://fortiguard.com/advisory/rsa-crt-key-leak-under-certain-conditions
Technical Description https://people.redhat.com/~fweimer/rsa-crt-leaks.pdf
Third Party Advisory https://support.f5.com/kb/en-us/solutions/public/k/91/sol91245485.html
Broken Link http://fortiguard.com/advisory/rsa-crt-key-leak-under-certain-conditions
Technical Description https://people.redhat.com/~fweimer/rsa-crt-leaks.pdf
Third Party Advisory https://support.f5.com/kb/en-us/solutions/public/k/91/sol91245485.html
36
/ 100
moderate-risk
Severity 26/34 · High
Exploitability 3/34 · Minimal
Exposure 7/34 · Low