Log in Start free

Vulnerability · Published Aug 29, 2024 · Assigned by wolfSSL

CVE-2024-1545Fault Injection of RSA encryption in WolfCrypt

Medium 5.9

In plain English

A medium-severity security flaw in wolfCrypt from WolfSSL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.6%top 52.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Fault Injection vulnerability in RsaPrivateDecryption function in wolfssl/wolfcrypt/src/rsa.c in WolfSSL wolfssl5.6.6 on Linux/Windows allows remote attacker co-resides in the same system with a victim process to disclose information and escalate privileges via Rowhammer fault injection to the RsaKey structure.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20wolfssl5.7.0-r0ALPINE-CVE-2024-1545
Alpine:v3.21wolfssl5.7.0-r0ALPINE-CVE-2024-1545
Alpine:v3.22wolfssl5.7.0-r0ALPINE-CVE-2024-1545
Alpine:v3.23wolfssl5.7.0-r0ALPINE-CVE-2024-1545
Alpine:v3.24wolfssl5.7.0-r0ALPINE-CVE-2024-1545
Debian:12wolfsslno fix listedDEBIAN-CVE-2024-1545
Debian:13wolfssl5.7.0-0.3DEBIAN-CVE-2024-1545
Ubuntu:22.04:LTSwolfsslno fix listedUBUNTU-CVE-2024-1545
Ubuntu:24.04:LTSwolfsslno fix listedUBUNTU-CVE-2024-1545
Ubuntu:25.10wolfsslno fix listedUBUNTU-CVE-2024-1545
Ubuntu:26.04:LTSwolfsslno fix listedUBUNTU-CVE-2024-1545
Ubuntu:26.10wolfsslno fix listedUBUNTU-CVE-2024-1545

Affected products (as reported)

VendorProductVersions
WolfSSL wolfCrypt 0 – through 5.6.6

Weakness: CWE-1256, CWE-252 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L

References