CVE-2021-29415

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

The elliptic curve cryptography (ECC) hardware accelerator, part of the ARM® TrustZone® CryptoCell 310, contained in the NordicSemiconductor nRF52840 through 2021-03-29 has a non-constant time ECDSA implemenation. This allows an adversary to recover the private ECC key used during an ECDSA operation.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-203

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://eprint.iacr.org/2021/640Third Party Advisory
https://www.aisec.fraunhofer.de/de/das-institut/wissenschaftliche-exzellenz/security-and-trust-in-open-source-security-tokens.htmlThird Party Advisory
https://www.sit.fraunhofer.de/en/news-events/downloads-services/cve/Not Applicable
https://eprint.iacr.org/2021/640Third Party Advisory
https://www.aisec.fraunhofer.de/de/das-institut/wissenschaftliche-exzellenz/security-and-trust-in-open-source-security-tokens.htmlThird Party Advisory
https://www.sit.fraunhofer.de/en/news-events/downloads-services/cve/Not Applicable

Timeline

Published: May 21, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-294166.5An issue was discovered in PortSwigger Burp Suite before 2021.2. During viewing of a malicious request, it can be manipulated into issuing a CVE-2021-294179.8gitjacker before 0.1.0 allows remote attackers to execute arbitrary code via a crafted .git directory because of directory traversal.CVE-2021-294185.3The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9. CVE-2021-294217.5models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.CVE-2021-294247.5The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address strin CVE-2021-294254.8In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\f CVE-2021-294277.2In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/or dependency poison CVE-2021-294287.8In Gradle before version 7.0, on Unix-like systems, the system temporary directory can be created with open permissions that allow multiple CVE-2021-294295.5In Gradle before version 7.0, files created with open permissions in the system temporary directory can allow an attacker to access informat CVE-2021-294307.5Sydent is a reference Matrix identity server. Sydent does not limit the size of requests it receives from HTTP clients. A malicious user cou CVE-2021-294316.5Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter CVE-2021-294325.7Sydent is a reference matrix identity server. A malicious user could abuse Sydent to send out arbitrary emails from the Sydent email address