Fault Injection vulnerability in wolfssl/wolfcrypt/src/ed25519.c allows remote attacker co-resides in the same system with a victim process to disclose information and escalate privileges via Rowhammer fault injection to the ed25519_key structure.

CVE-2024-2881
8.8HIGH

Key Information

Vendor
Wolfssl
Status
Wolfcrypt
Vendor
CVE Published:
30 August 2024

Summary

Fault Injection vulnerability in wc_ed25519_sign_msg function in wolfssl/wolfcrypt/src/ed25519.c in WolfSSL wolfssl5.6.6 on Linux/Windows allows remote attacker co-resides in the same system with a victim process to disclose information and escalate privileges via Rowhammer fault injection to the ed25519_key structure.

Affected Version(s)

wolfCrypt <= 5.6.6

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Risk change from: null to: 6.7 - (MEDIUM)

  • Vulnerability published.

Collectors

NVD DatabaseMitre Database
.