ByteOS Network

NVD Vulnerability Details :

CVE-2023-33241

Analyzed

Source-disclosures@halborn.com

Published At-09 Aug, 2023 | 22:15

Updated At-25 Aug, 2023 | 16:14

Crypto wallets implementing the GG18 or GG20 TSS protocol might allow an attacker to extract a full ECDSA private key by injecting a malicious pallier key and cheating in the range proof. Depending on the Beta parameters chosen in the protocol implementation, the attack might require 16 signatures or more fully exfiltrate the other parties' private key shares.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	9.1	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Secondary	3.1	9.6	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

CPE Matches

gg18_project>>gg18>>-

cpe:2.3:a:gg18_project:gg18:-:*:*:*:*:*:*:*

gg20_project>>gg20>>-

cpe:2.3:a:gg20_project:gg20:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-74	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
https://eprint.iacr.org/2019/114.pdf	disclosures@halborn.com	Exploit Third Party Advisory
https://eprint.iacr.org/2020/540.pdf	disclosures@halborn.com	Exploit Third Party Advisory
https://github.com/fireblocks-labs/mpc-ecdsa-attacks-23	disclosures@halborn.com	Exploit
https://github.com/fireblocks-labs/safeheron-gg20-exploit-poc	disclosures@halborn.com	Exploit
https://www.fireblocks.com/blog/gg18-and-gg20-paillier-key-vulnerability-technical-report/	disclosures@halborn.com	Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History