CVE-2021-36647
published 2023-01-17CVE-2021-36647: Use of a Broken or Risky Cryptographic Algorithm in the function mbedtls_mpi_exp_mod() in lignum.c in Mbed TLS Mbed TLS all versions before 3.0.0, 2.27.0 or…
PriorityP421medium4.7CVSS 3.1
AVLACHPRLUINSUCHINAN
EPSS
0.16%
5.9th percentile
Use of a Broken or Risky Cryptographic Algorithm in the function mbedtls_mpi_exp_mod() in lignum.c in Mbed TLS Mbed TLS all versions before 3.0.0, 2.27.0 or 2.16.11 allows attackers with access to precise enough timing and memory access information (typically an untrusted operating system attacking a secure enclave such as SGX or the TrustZone secure world) to recover the private keys used in RSA.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| arm | mbed_tls | < 2.16.11 | 2.16.11 |
| arm | mbed_tls | >= 2.17.0 < 2.27.0 | 2.27.0 |
| debian | mbedtls | < mbedtls 2.16.11-0.1 (bookworm) | mbedtls 2.16.11-0.1 (bookworm) |
| mbed | mbedtls | >= 0 < 2.16.9-0.1+deb11u1 | 2.16.9-0.1+deb11u1 |
| mbed | mbedtls | >= 0 < 2.16.11-0.1 | 2.16.11-0.1 |
| mbed | mbedtls | >= 0 < 2.16.11-0.1 | 2.16.11-0.1 |
| mbed | mbedtls | >= 0 < 2.16.11-0.1 | 2.16.11-0.1 |
| msrc | azl3_qemu_8.2.0-16_on_azure_linux_3.0 | — | — |
| msrc | cbl2_hvloader_1.0.1-5_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_qemu_6.2.0-24_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| msrc | fluent-bit-2.0.9-1.cm2.aarch64.rpm_on_cbl_mariner_2.0_arm | — | — |
| msrc | fluent-bit-2.0.9-1.cm2.x86_64.rpm_on_cbl_mariner_2.0_x64 | — | — |
| msrc | fluent-bit-debuginfo-2.0.9-1.cm2.aarch64.rpm_on_cbl_mariner_2.0_arm | — | — |
| msrc | fluent-bit-debuginfo-2.0.9-1.cm2.x86_64.rpm_on_cbl_mariner_2.0_x64 | — | — |
| msrc | fluent-bit-devel-2.0.9-1.cm2.aarch64.rpm_on_cbl_mariner_2.0_arm | — | — |
| msrc | fluent-bit-devel-2.0.9-1.cm2.x86_64.rpm_on_cbl_mariner_2.0_x64 | — | — |
| msrc | hvloader-1.0.1-6.cm2.x86_64.rpm_on_cbl_mariner_2.0_x64 | — | — |
| trustedfirmware | mbed_tls | >= 2.28.0 < 3.0.0 | 3.0.0 |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
osv4.7MEDIUM
vendor_debian4.7MEDIUM
vendor_msrc4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Use of a Broken or Risky Cryptographic Algorithm in the function mbedtls_mpi_exp_mod() in lignum.c in Mbed TLS Mbed TLS all versions before 3.0.0 2.27.0 or 2.16.11 allows attackers with access to prec
vendor_msrc·2023-01-10·CVSS 4.7
CVE-2021-36647 [MEDIUM] CWE-327 Use of a Broken or Risky Cryptographic Algorithm in the function mbedtls_mpi_exp_mod() in lignum.c in Mbed TLS Mbed TLS all versions before 3.0.0 2.27.0 or 2.16.11 allows attackers with access to prec
Use of a Broken or Risky Cryptographic Algorithm in the function mbedtls_mpi_exp_mod() in lignum.c in Mbed TLS Mbed TLS all versions before 3.0.0 2.27.0 or 2.16.11 allows attackers with access to precise enough timing and memory access information (typically an untrusted operating system attacking a secure enclave such as SGX or the TrustZone secure world) to recover the private keys used in RSA.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is commit
Debian
CVE-2021-36647: mbedtls - Use of a Broken or Risky Cryptographic Algorithm in the function mbedtls_mpi_exp...
vendor_debian·2021·CVSS 4.7
CVE-2021-36647 [MEDIUM] CVE-2021-36647: mbedtls - Use of a Broken or Risky Cryptographic Algorithm in the function mbedtls_mpi_exp...
Use of a Broken or Risky Cryptographic Algorithm in the function mbedtls_mpi_exp_mod() in lignum.c in Mbed TLS Mbed TLS all versions before 3.0.0, 2.27.0 or 2.16.11 allows attackers with access to precise enough timing and memory access information (typically an untrusted operating system attacking a secure enclave such as SGX or the TrustZone secure world) to recover the private keys used in RSA.
Scope: local
bookworm: resolved (fixed in 2.16.11-0.1)
bullseye: resolved (fixed in 2.16.9-0.1+deb11u1)
forky: resolved (fixed in 2.16.11-0.1)
sid: resolved (fixed in 2.16.11-0.1)
trixie: resolved (fixed in 2.16.11-0.1)
VulDB
Mbed TLS up to 2.16.10/2.26.x lignum.c mbedtls_mpi_exp_mod risky encryption (Nessus ID 240979)
vuldb·2026-06-06·CVSS 4.7
CVE-2021-36647 [MEDIUM] Mbed TLS up to 2.16.10/2.26.x lignum.c mbedtls_mpi_exp_mod risky encryption (Nessus ID 240979)
A vulnerability classified as problematic was found in Mbed TLS up to 2.16.10/2.26.x. The affected element is the function mbedtls_mpi_exp_mod of the file lignum.c. The manipulation results in risky cryptographic algorithm.
This vulnerability is reported as CVE-2021-36647. The attack requires a local approach. No exploit exists.
Upgrading the affected component is advised.
GHSA
GHSA-7wwm-8prx-hpg2: Use of a Broken or Risky Cryptographic Algorithm in the function mbedtls_mpi_exp_mod() in lignum
ghsa_unreviewed·2023-01-17
CVE-2021-36647 [MEDIUM] CWE-327 GHSA-7wwm-8prx-hpg2: Use of a Broken or Risky Cryptographic Algorithm in the function mbedtls_mpi_exp_mod() in lignum
Use of a Broken or Risky Cryptographic Algorithm in the function mbedtls_mpi_exp_mod() in lignum.c in Mbed TLS Mbed TLS all versions before 3.0.0, 2.27.0 or 2.16.11 allows attackers with access to precise enough timing and memory access information (typically an untrusted operating system attacking a secure enclave such as SGX or the TrustZone secure world) to recover the private keys used in RSA.
OSV
CVE-2021-36647: Use of a Broken or Risky Cryptographic Algorithm in the function mbedtls_mpi_exp_mod() in lignum
osv·2023-01-17·CVSS 4.7
CVE-2021-36647 [MEDIUM] CVE-2021-36647: Use of a Broken or Risky Cryptographic Algorithm in the function mbedtls_mpi_exp_mod() in lignum
Use of a Broken or Risky Cryptographic Algorithm in the function mbedtls_mpi_exp_mod() in lignum.c in Mbed TLS Mbed TLS all versions before 3.0.0, 2.27.0 or 2.16.11 allows attackers with access to precise enough timing and memory access information (typically an untrusted operating system attacking a secure enclave such as SGX or the TrustZone secure world) to recover the private keys used in RSA.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/ARMmbed/mbedtls/releases/https://kouzili.com/Load-Step.pdfhttps://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2021-07-1https://github.com/ARMmbed/mbedtls/releases/https://kouzili.com/Load-Step.pdfhttps://lists.debian.org/debian-lts-announce/2025/06/msg00034.htmlhttps://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2021-07-1
2023-01-17
Published