Fault Injection Vulnerability in wolfSSL Affects ECDSA Key Security
CVE-2022-42961

5.3MEDIUM

Key Information:

Vendor

Wolfssl

Status
Wolfssl
Vendor
CVE Published:
15 October 2022

What is CVE-2022-42961?

A vulnerability was identified in wolfSSL versions prior to 5.5.0 that allows for a fault injection attack leveraging the Rowhammer effect, leading to the potential disclosure of ECDSA keys. This risk is particularly critical when users perform signing operations with private ECC keys. Through this vulnerability, attackers can extract faulty ECC signatures, enabling advanced techniques for key recovery. It is advisable for users to upgrade to version 5.5.0 or later, where the WOLFSSL_CHECK_SIG_FAULTS feature has been implemented to mitigate this issue.

References

https://github.com/wolfSSL/wolfssl/releases/tag/v5.5.0-st...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.