CVE-2018-3691 Weak cryptography in Integrated Performance Primitives Cryptography Library
Attackers can exploit timing side-channels in Intel IPP Cryptography Library to potentially recover sensitive cryptographic keys.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-3691?
CVE-2018-3691 is a medium-severity vulnerability in Intel Corporation Integrated Performance Primitives Cryptography Library, published on 5 Jun 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Some implementations in Intel Integrated Performance Primitives Cryptography Library before version 2018 U3.1 do not properly ensure constant execution time.
Which versions are affected by CVE-2018-3691?
It affects 1 product.
Products include Intel Integrated Performance Primitives Cryptography.
How do I fix CVE-2018-3691?
No fix has been published for CVE-2018-3691 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-3691 being exploited?
There is no known exploitation of CVE-2018-3691 in the wild and no public exploit code.
Other vulnerabilities in Intel Corporation Integrated Performance Primitives Cryptography Library
- CVE-2022-26083 Weak cryptography in Intel(R) IPP Cryptography software library
- CVE-2021-33147 Information disclosure in Intel(R) IPP Crypto library
- CVE-2024-21784 Privilege escalation in Intel(R) IPP Cryptography software
- CVE-2022-37409 Information disclosure in Intel(R) IPP Cryptography software
- CVE-2022-41646 Information disclosure in Intel(R) IPP Cryptography software
Sources
Also known as CVE-2018-3617, GHSA-8774-h3c9-hphw.