cve/2023/CVE-2023-33242.md

### [CVE-2023-33242](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-33242)
![](https://img.shields.io/static/v1?label=Product&message=Wallet&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%2017%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Private%20Key%20Exfiltration&color=brighgreen)

### Description

Crypto wallets implementing the Lindell17 TSS protocol might allow an attacker to extract the full ECDSA private key by exfiltrating a single bit in every signature attempt (256 in total) because of not adhering to the paper's security proof's assumption regarding handling aborts after a failed signature.

### POC

#### Reference
- https://github.com/fireblocks-labs/zengo-lindell17-exploit-poc
- https://www.fireblocks.com/blog/lindell17-abort-vulnerability-technical-report/

#### Github
- https://github.com/d0rb/CVE-2023-33242
- https://github.com/dcar2121/Acme
- https://github.com/nomi-sec/PoC-in-GitHub