« Volver al listado

CVE-2022-23003

Estado: ModificadaMedia (5.3)—

When computing a shared secret or point multiplication on the NIST P-256 curve that results in an X coordinate of zero, the resulting output is not properly reduced modulo the P-256 field prime and is invalid. The resulting output may cause an error when used in other operations. This may be leveraged by an attacker to cause an error scenario or incorrect choice of session key in applications which use the library, resulting in a limited denial of service for an individual user. The scope of impact cannot extend to other components.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Westerndigital — Sweet B

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-23003",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@wdc.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@wdc.com",
      "affectedData": [
        {
          "vendor": "Western Digital",
          "product": "Sweet B Library",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "v2",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-07-29T19:15:08.287",
  "references": [
    {
      "url": "https://www.westerndigital.com/support/product-security/wdc-22013-sweet-b-incorrect-output-vulnerabilities",
      "tags": [
        "Product",
        "Vendor Advisory"
      ],
      "source": "psirt@wdc.com"
    },
    {
      "url": "https://www.westerndigital.com/support/product-security/wdc-22013-sweet-b-incorrect-output-vulnerabilities",
      "tags": [
        "Product",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@wdc.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-703"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-682"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "When computing a shared secret or point multiplication on the NIST P-256 curve that results in an X coordinate of zero, the resulting output is not properly reduced modulo the P-256 field prime and is invalid. The resulting output may cause an error when used in other operations. This may be leveraged by an attacker to cause an error scenario or incorrect choice of session key in applications which use the library, resulting in a limited denial of service for an individual user. The scope of impact cannot extend to other components."
    },
    {
      "lang": "es",
      "value": "Cuando es computado un secreto compartido o una multiplicación de puntos en la curva P-256 del NIST que resulta en una coordenada X de cero, el resultado no es reducido apropiadamente modulo el primo del campo P-256 y es inválido. El resultado puede causar un error cuando es usada en otras operaciones. Esto puede ser aprovechado por un atacante para causar un escenario de error o una elección incorrecta de la clave de sesión en las aplicaciones que usan la biblioteca, resultando en una denegación de servicio limitada para un usuario individual. El alcance del impacto no puede extenderse a otros componentes"
    }
  ],
  "lastModified": "2026-06-17T04:29:19.920",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:westerndigital:sweet_b:1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BD0868BB-4143-41EC-9A15-C16C98EF851C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@wdc.com"
}