Fault Injection Vulnerability in wolfSSL Affects ECDSA Key Security
CVE-2022-42961

5.3MEDIUM

Key Information:

Vendor
Wolfssl
Status
Wolfssl
Vendor
CVE Published:
15 October 2022

Summary

A vulnerability was identified in wolfSSL versions prior to 5.5.0 that allows for a fault injection attack leveraging the Rowhammer effect, leading to the potential disclosure of ECDSA keys. This risk is particularly critical when users perform signing operations with private ECC keys. Through this vulnerability, attackers can extract faulty ECC signatures, enabling advanced techniques for key recovery. It is advisable for users to upgrade to version 5.5.0 or later, where the WOLFSSL_CHECK_SIG_FAULTS feature has been implemented to mitigate this issue.

References

https://github.com/wolfSSL/wolfssl/releases/tag/v5.5.0-st...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.