CVE-2022-46392 Information disclosure in n/a
An attacker with precise memory access can recover RSA private keys from Mbed TLS if the window size is small, requiring an upgrade to secure versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-46392?
CVE-2022-46392 is a medium-severity vulnerability in Arm Mbed Tls, published on 15 Dec 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. An adversary with access to precise enough information about memory accesses (typically, an untrusted operating system attacking a secure enclave) can recover an RSA private key after observing the victim performing a single private-key operation, if the window size (MBEDTLS_MPI_WINDOW_SIZE) used for the exponentiation is 3 or smaller.
Weakness: CWE-203
Which versions are affected by CVE-2022-46392?
It affects 3 products.
Products include Arm Mbed Tls, Fedoraproject Fedora, Trustedfirmware Mbed Tls.
How do I fix CVE-2022-46392?
Upgrade to a fixed version.
Is CVE-2022-46392 being exploited?
There is no known exploitation of CVE-2022-46392 in the wild and no public exploit code.
Other vulnerabilities in Arm Mbed Tls
Sources
Also known as AZL-12968, DEBIAN-CVE-2022-46392, GHSA-2cww-m3rc-2vgr, JLSEC-2025-219, UBUNTU-CVE-2022-46392.