CVE-2018-19608

Vulnerability

Arm Mbed TLS versions prior to 2.14.1, 2.7.8, and 2.1.17 are vulnerable to a cache-based side-channel attack that leaks information during RSA decryption when using PKCS#1 v1.5 padding. The vulnerability resides in the RSA implementation and affects cipher suites without (EC)DH(E), allowing a local unprivileged attacker to recover plaintext from captured ciphertexts [1].

Exploitation

An unprivileged local attacker requires the ability to observe cache timing or access patterns on the victim machine while the target Mbed TLS process performs RSA decryption. The attacker must first capture an RSA ciphertext (e.g., by network sniffing) and then trigger multiple decryption operations, performing adaptive chosen-ciphertext queries to exploit the Bleichbacher oracle. By parallelizing queries across multiple TLS servers sharing the same public key, the attack can complete within browser timeouts (30 seconds) [1].

Impact

Successful exploitation allows the attacker to recover the RSA plaintext, including the premaster secret in TLS connections. This breaks the confidentiality of the TLS session, enabling decryption of all subsequent traffic secured by that session key. The attacker gains plaintext recovery at the cryptographic level without needing higher privileges [1].

Mitigation

Arm Mbed TLS fixed this vulnerability in versions 2.14.1, 2.7.8, and 2.1.17 released in October 2018. Users should upgrade to patched versions immediately. No workaround is available; disabling RSA cipher suites without (EC)DHE is a partial mitigation but may break compatibility. The CVE is not listed on CISA's Known Exploited Vulnerabilities [1].