CVE-2024-23170: arm mbed_tls Observable Discrepancy
Vulnerability summary
CVE-2024-23170 is a medium (CVSS 5.5) Observable Discrepancy vulnerability in arm mbed_tls. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 22.9% of scored vulnerabilities.
Timeline
- 31-01-2024PublishedVulnerability first disclosed.
- 04-11-2025Last modifiedVulnerability information updated.
Description
An issue was discovered in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2. There was a timing side channel in RSA private operations. This side channel could be sufficient for a local attacker to recover the plaintext. It requires the attacker to send a large number of messages for decryption, as described in "Everlasting ROBOT: the Marvin Attack" by Hubert Kario.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · AlpineEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.31%
Chance of exploitation in the next 30 days
Percentile
23%
Versus all other CVEs
30-day change
0.00 pp
From 0.31% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-203Observable DiscrepancyThe product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
- CWE-385Covert Timing ChannelCovert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information.
Affected systems
Opensuse3 products
- mbedtls-2&distro=openSUSE Tumbleweed< 2.28.7-1.1
- mbedtls&distro=openSUSE Leap 15.5< 2.28.7-bp155.2.3.1
- mbedtls&distro=openSUSE Tumbleweed< 3.5.2-1.1
Alpine1 product
- mbedtls< 2.28.7-r0
Arm1 product
- mbed_tls≥ 2.0.0, < 2.28.7
Debian1 product
- mbedtlsAll versions (No fix recorded) | < 2.28.7-1
Suse1 product
- mbedtls&distro=SUSE Package Hub 15 SP5< 2.28.7-bp155.2.3.1
Trustedfirmware1 product
- mbed_tls≥ 3.0.0, < 3.5.2
Ubuntu1 product
- mbedtlsAll versions (No fix recorded)
7 vendors · 9 products
References
13 links- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.opensuse.org/archives/…Advisory
