id: GO-2022-0187
modules:
    - module: std
      versions:
        - introduced: 1.6.0-0
        - fixed: 1.7.6
        - introduced: 1.8.0-0
        - fixed: 1.8.2
      vulnerable_at: 1.8.1
      packages:
        - package: crypto/elliptic
          goarch:
            - amd64
          symbols:
            - p256SubInternal
summary: Incorrect computation for P-256 curves in crypto/elliptic
description: |-
    The ScalarMult implementation of curve P-256 for amd64 architectures generates
    incorrect results for certain specific input points. An adaptive attack can
    progressively extract the scalar input to ScalarMult by submitting crafted
    points and observing failures to derive correct output. This leads to a full key
    recovery attack against static ECDH, as used in popular JWT libraries.
published: 2022-07-01T20:11:15Z
cves:
    - CVE-2017-8932
credits:
    - Vlad Krasnov
    - Filippo Valsorda at Cloudflare
references:
    - fix: https://go.dev/cl/41070
    - fix: https://go.googlesource.com/go/+/9294fa2749ffee7edbbb817a0ef9fe633136fa9c
    - report: https://go.dev/issue/20040
    - web: https://groups.google.com/g/golang-announce/c/B5ww0iFt1_Q/m/TgUFJV14BgAJ
review_status: REVIEWED