CVEvulnerability
CVE-2015-5738
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2016-07-26
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
The RSA-CRT implementation in the Cavium Software Development Kit (SDK) 2.x, when used on OCTEON II CN6xxx Hardware on Linux to support TLS with Perfect Forward Secrecy (PFS), makes it easier for remote attackers to obtain private RSA keys by conducting a Lenstra side-channel attack.
Affected configurations
• marvell software development kit 2.0
• f5 traffix signaling delivery controller (>= 3.3.2 <= 3.5.1)
• f5 traffix signaling delivery controller (>= 4.0.0 <= 4.4.0)
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://fortiguard.com/advisory/rsa-crt-key-leak-under-certain-conditions Broken Link
- https://people.redhat.com/~fweimer/rsa-crt-leaks.pdf Technical Description, Third Party Advisory
- https://support.f5.com/kb/en-us/solutions/public/k/91/sol91245485.html Third Party Advisory
- http://fortiguard.com/advisory/rsa-crt-key-leak-under-certain-conditions Broken Link
- https://people.redhat.com/~fweimer/rsa-crt-leaks.pdf Technical Description, Third Party Advisory
- https://support.f5.com/kb/en-us/solutions/public/k/91/sol91245485.html Third Party Advisory