CVE-2024-45678 Information disclosure in n/a
Attackers with physical access and specialized equipment can extract ECDSA secret keys from YubiKey devices via electromagnetic side-channel attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-45678?
CVE-2024-45678 is a medium-severity vulnerability in n/a, published on 3 Sep 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware before 2.4.0 allow an ECDSA secret-key extraction attack (that requires physical access and expensive equipment) in which an electromagnetic side channel is present because of a non-constant-time modular inversion for the Extended Euclidean Algorithm, aka the EUCLEAK issue. Other uses of an Infineon cryptographic library may also be affected.
Weakness: CWE-203
Which versions are affected by CVE-2024-45678?
It affects 18 products.
Products include Yubico Security Key C Nfc by Yubico Firmware, Yubico Security Key Nfc by Yubico Firmware, Yubico Yubihsm 2 Fips Firmware, Yubico Yubihsm 2 Firmware, Yubico Yubikey 5 Nano Fips Firmware, Yubico Yubikey 5 Nano Firmware and 12 more.
How do I fix CVE-2024-45678?
No fix has been published for CVE-2024-45678 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-45678 being exploited?
There is no known exploitation of CVE-2024-45678 in the wild and no public exploit code.
Sources
Also known as GHSA-cf4q-v7mm-g53q.