CVE-2015-5738 Information disclosure in n/a

High 7.5 Published 26 Jul 2016 Updated 6 Aug 2024

Remote attackers can obtain private RSA keys via a side-channel attack when using Cavium SDK with TLS PFS on specific hardware.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2015-5738?

CVE-2015-5738 is a high-severity vulnerability in n/a, published on 26 Jul 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The RSA-CRT implementation in the Cavium Software Development Kit (SDK) 2.x, when used on OCTEON II CN6xxx Hardware on Linux to support TLS with Perfect Forward Secrecy (PFS), makes it easier for remote attackers to obtain private RSA keys by conducting a Lenstra side-channel attack.

Weakness: CWE-200

Which versions are affected by CVE-2015-5738?

It affects 2 products.

Products include F5 Traffix Signaling Delivery Controller, Marvell Software Development Kit.

How do I fix CVE-2015-5738?

Apply the vendor's patch.

Is CVE-2015-5738 being exploited?

There is no known exploitation of CVE-2015-5738 in the wild and no public exploit code.

Sources

Also known as GHSA-rf7q-m4h8-9j2r.