CVE-2022-23004
Algorithm incorrectly returning error and Invalid unreduced value written to output buffer
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jul 29, 2022
- Updated
- Aug 3, 2024
- Reserved
- Jan 10, 2022
Description
When computing a shared secret or point multiplication on the NIST P-256 curve using a public key with an X coordinate of zero, an error is returned from the library, and an invalid unreduced value is written to the output buffer. This may be leveraged by an attacker to cause an error scenario, resulting in a limited denial of service for an individual user. The scope of impact cannot extend to other components.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | WDC PSIRT |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Sweet B LibraryWestern Digital |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.