Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2022-23004— Algorithm incorrectly returning error and Invalid unreduced value written to output buffer

Quick assessment

Affected
Western Digital Sweet B Library
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Western Digital Sweet B是美国Western Digital公司的一个使用 NIST P-256 和 SECG secp256k1 曲线实现公钥椭圆曲线加密 (ECC) 的库。 Western Digital Sweet B library存在安全漏洞，该漏洞源于当使用X坐标为零的公钥在NIST P-256曲线上计算共享密钥或点乘时，将从库返回一个错误，并将一个无效的未删减值写入输出缓冲区。攻击者可能利用这一点来导致错误场景，从而对单个用户造成有限的拒绝服务。

CVSS 5.3 · Medium EPSS 0.70% · P51

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-23004

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Algorithm incorrectly returning error and Invalid unreduced value written to output buffer
Source: CVE Program / CVE List V5
Vulnerability Description
When computing a shared secret or point multiplication on the NIST P-256 curve using a public key with an X coordinate of zero, an error is returned from the library, and an invalid unreduced value is written to the output buffer. This may be leveraged by an attacker to cause an error scenario, resulting in a limited denial of service for an individual user. The scope of impact cannot extend to other components.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
对消息或数据结构的处理不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Western Digital Sweet B 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Western Digital Sweet B是美国Western Digital公司的一个使用 NIST P-256 和 SECG secp256k1 曲线实现公钥椭圆曲线加密 (ECC) 的库。 Western Digital Sweet B library存在安全漏洞，该漏洞源于当使用X坐标为零的公钥在NIST P-256曲线上计算共享密钥或点乘时，将从库返回一个错误，并将一个无效的未删减值写入输出缓冲区。攻击者可能利用这一点来导致错误场景，从而对单个用户造成有限的拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Western Digital Sweet B Library Sweet B Library ~ v2 -

II. Public POCs for CVE-2022-23004

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-23004

请登录查看更多情报信息。

Other References for CVE-2022-23004 (1)

Same Patch Batch · Western Digital · 2022-07-29 · 4 CVEs total

CVE-2022-23001 5.3 MEDIUM Sweet-B Library: Point compress/decompress using the wrong bit for sign
CVE-2022-23002 5.3 MEDIUM Point Compression/Decompression of NIST P-256 points with X coordinate of zero
CVE-2022-23003 5.3 MEDIUM Shared secret or Point multiplication of NIST P-256 points with X coordinate of zero

IV. Related Vulnerabilities

Same product: Sweet B Library
Same vendor: Western Digital
Same weakness: CWE-707

V. Comments for CVE-2022-23004

No comments yet

Leave a comment