CVE-2024-23170

What it actually does

Timing side channel in RSA private key operations in Mbed TLS allows a local attacker to recover decrypted plaintext after observing a large number of decryption operations.

Why it matters to the business

Attackers with local access could obtain sensitive decrypted data such as keys or messages processed by applications relying on vulnerable Mbed TLS versions, increasing risk of data exposure in embedded and IoT deployments.

How an attack unfolds

A local attacker repeatedly sends crafted ciphertexts to trigger RSA private key operations, measures subtle timing differences across many requests, and applies the Marvin attack technique to reconstruct the plaintext without needing the private key.

How to fix it

Upgrade Mbed TLS to version 2.28.7, 3.5.2, or later; apply commit 555f84735aecdbd76a566cf087ec8425dfb0c8ab where appropriate; recompile and redeploy all dependent applications.

How to confirm the fix worked

Verify installed Mbed TLS version is at or above the fixed releases; run timing side-channel test suites against RSA operations; confirm no plaintext leakage in controlled decryption benchmarks.

Typical attack path

1. Obtain local execution privileges on the target system
2. Identify processes performing RSA decryption with Mbed TLS
3. Send a large volume of specially crafted decryption requests
4. Collect high-resolution timing measurements of the operations
5. Analyze timing data offline to recover plaintext

How to detect it

Review process execution logs and library version strings for vulnerable Mbed TLS builds; look for processes performing unusually high volumes of RSA decryption operations; examine application logs for repeated decryption activity from local users.

What your security team should do

• Prioritize upgrade of Mbed TLS across all affected products and rebuild dependent binaries
• Audit applications for direct use of RSA private operations and consider migrating to constant-time alternatives
• Monitor upstream Mbed TLS releases for any follow-on side-channel fixes
• Limit local access to systems performing sensitive RSA decryption where feasible