CVE-2021-29415

Published: May 21, 2021Modified: Nov 21, 2024

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

The elliptic curve cryptography (ECC) hardware accelerator, part of the ARM® TrustZone® CryptoCell 310, contained in the NordicSemiconductor nRF52840 through 2021-03-29 has a non-constant time ECDSA implemenation. This allows an adversary to recover the private ECC key used during an ECDSA operation.

Affected (1)

Products: Nordicsemi: Nrf52840 Firmware

1 product

Nrf52840 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Nordicsemi Nrf52840 Firmware	Up to 2021-03-29

Running on/with	Platform Versions
Nordicsemi Nrf52840	All versions

Related CWEs

Observable Discrepancy

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

References (6)

https://eprint.iacr.org/2021/640

Source: cve@mitre.org

Third Party Advisory

https://www.aisec.fraunhofer.de/de/das-institut/wissenschaftliche-exzellenz/security-and-trust-in-open-source-security-tokens.html

Source: cve@mitre.org

Third Party Advisory

https://www.sit.fraunhofer.de/en/news-events/downloads-services/cve/

Source: cve@mitre.org

Not Applicable

https://eprint.iacr.org/2021/640

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.aisec.fraunhofer.de/de/das-institut/wissenschaftliche-exzellenz/security-and-trust-in-open-source-security-tokens.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.sit.fraunhofer.de/en/news-events/downloads-services/cve/

Source: af854a3a-2127-422b-91ae-364da2661108

Not Applicable

Timeline

No history available yet.