Is CVE-2016-6887 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-6887 being exploited in the wild.

How severe is CVE-2016-6887?

Medium severity, with a CVSS score of 5.9, published 13 January 2017.

Which products and versions are affected?

MatrixSSL MatrixSSL 3.8.6 and earlier.

Is there a fix for CVE-2016-6887?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2016-6887 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2016-6887?

Check whether you run Matrixssl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-6887: MatrixSSL incorrect modular exponentiation in pstm_exptmod

CVE-2016-6887 · Severity: medium · CVSS 5.9 · Published 2017-01-13

MatrixSSL is a lightweight security library used to provide encrypted communications for embedded devices and Internet of Things (IoT) hardware. A flaw in its mathematical processing allows remote attackers to potentially recover secret private keys during the digital signing process. If exploited, this could allow an attacker to impersonate the device, decrypt sensitive communications, or compromise the integrity of the system's security.

Technologies: Matrixssl. Vendors: Matrixssl.

Quick answers

Is CVE-2016-6887 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-6887 being exploited in the wild.
How severe is CVE-2016-6887?: Medium severity, with a CVSS score of 5.9, published 13 January 2017.
Which products and versions are affected?: MatrixSSL MatrixSSL 3.8.6 and earlier.
Is there a fix for CVE-2016-6887?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2016-6887 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2016-6887?: Check whether you run Matrixssl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the `pstm_exptmod` function of MatrixSSL due to improper implementation of modular exponentiation. The function can produce incorrect calculation results for certain input values. When these errors occur during RSA signature generation using the Chinese Remainder Theorem (CRT) optimization, a remote attacker can mathematically derive the server's private key from the faulty signature. While MatrixSSL attempted to mitigate this in version 3.8.4 by restricting inputs to specific bit sizes (e.g., 1024, 2048), the underlying logic error persisted in versions up to 3.8.6. A separate protection mechanism against CRT attacks was introduced in version 3.8.3.

Affected products

MatrixSSL MatrixSSL 3.8.6 and earlier

Timeline

2016-07-31: disclosed: Initial public disclosure by Hanno Böck of The Fuzzing Project
2017-01-13: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.