CVE-2024-5288

Aug. 28, 2024, 12:57 p.m.

Tags

CWE-922
2024-08-27
facts@wolfssl.com
CVE-2024-5288

CVSS Score

5.1 / 10

Product(s) Impacted

wolfSSL

  • before 5.7.0

Description

An issue was discovered in wolfSSL before 5.7.0. A safe-error attack via Rowhammer, namely FAULT+PROBE, leads to ECDSA key disclosure. When WOLFSSL_CHECK_SIG_FAULTS is used in signing operations with private ECC keys, such as in server-side TLS connections, the connection is halted if any fault occurs. The success rate in a certain amount of connection requests can be processed via an advanced technique for ECDSA key recovery.

Weaknesses

CWE-922
Insecure Storage of Sensitive Information

The product stores sensitive information without properly limiting read or write access by unauthorized actors.

CWE ID: 922

Date

Published: Aug. 27, 2024, 7:15 p.m.

Last Modified: Aug. 28, 2024, 12:57 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

facts@wolfssl.com

CVSS Data

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

Base Score
5.1
Exploitability Score
1.4
Impact Score
3.6
Base Severity
MEDIUM
CVSS Vector String

The CVSS vector string provides an in-depth view of the vulnerability metrics.

View Vector String

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/wolfSSL/wolfssl/releases/tag/v5.7.2-stable
facts@wolfssl.com