Executive brief
MatrixSSL is a lightweight security library used to provide encrypted communications for embedded devices and Internet of Things (IoT) hardware. A flaw in its mathematical processing allows remote attackers to potentially recover secret private keys during the digital signing process. If exploited, this could allow an attacker to impersonate the device, decrypt sensitive communications, or compromise the integrity of the system's security.
Technical details
A vulnerability exists in the `pstm_exptmod` function of MatrixSSL due to improper implementation of modular exponentiation. The function can produce incorrect calculation results for certain input values. When these errors occur during RSA signature generation using the Chinese Remainder Theorem (CRT) optimization, a remote attacker can mathematically derive the server's private key from the faulty signature. While MatrixSSL attempted to mitigate this in version 3.8.4 by restricting inputs to specific bit sizes (e.g., 1024, 2048), the underlying logic error persisted in versions up to 3.8.6. A separate protection mechanism against CRT attacks was introduced in version 3.8.3.
Affected products
- MatrixSSL MatrixSSL 3.8.6 and earlier
Timeline
- 2016-07-31: disclosed: Initial public disclosure by Hanno Böck of The Fuzzing Project
- 2017-01-13: advisory: NVD publication date