Fault Injection vulnerability in wolfssl/wolfcrypt/src/ed25519.c allows remote attacker co-resides in the same system with a victim process to disclose information and escalate privileges via Rowhammer fault injection to the ed25519_key structure.

Summary

A fault injection vulnerability has been identified in the wc_ed25519_sign_msg function within WolfSSL version 5.6.6. This vulnerability is specific to environments where an attacker shares the same system with a targeted process. By leveraging Rowhammer fault injection tactics, an attacker can exploit weaknesses in the ed25519_key structure, leading to potential information disclosure and unauthorized privilege escalation. It is crucial for users of affected versions to apply patches and follow security best practices to mitigate these risks.

References