CVE-2015-5738 describes a critical vulnerability in the RSA-CRT implementation within the Cavium SDK 2.x, specifically impacting OCTEON II CN6xxx Hardware running Linux with TLS and Perfect Forward Secrecy (PFS). This flaw allows remote attackers to extract private RSA keys through a Lenstra side-channel attack, affecting various F5 and Marvell products utilizing the vulnerable SDK. With a CVSS score of 7.5 (High), the vulnerability is network-exploitable with low attack complexity, potentially leading to complete compromise of confidentiality. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered some community discussion, indicating awareness of its potential impact.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.0CPE matchmatch criteria | cpe:2.3:a:marvell:software_development_kit:2.0:*:*:*:*:*:*:* | ||
>= 3.3.2, <= 3.5.1CPE matchmatch criteria | cpe:2.3:a:f5:traffix_signaling_delivery_controller:*:*:*:*:*:*:*:* | ||
>= 4.0.0, <= 4.4.0CPE matchmatch criteria | cpe:2.3:a:f5:traffix_signaling_delivery_controller:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2015-5738
Sep 8, 2020The RSA-CRT implementation in the Cavium Software Development Kit (SDK) 2.x when used on OCTEON II CN6xxx Hardware on Linux to support TLS with Perfect Forward Secrecy (PFS) makes it easier for remote attackers to obtain private RSA keys by conducting a Lenstra side-channel attack.
Jul 12, 2016