CVE-2024-2881

2024-08-3000:15:04

Debian Security Bug Tracker

security-tracker.debian.org

vulnerability

fault injection

wolfssl5.6.6

disclosure

escalation

privileges

rowhammer

ed25519_key

structure

unix

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

Low

EPSS

0.001

Percentile

20.0%

JSON

Fault Injection vulnerability in wc_ed25519_sign_msg function in wolfssl/wolfcrypt/src/ed25519.c in WolfSSL wolfssl5.6.6 on Linux/Windows allows remote attacker co-resides in the same system with a victim process to disclose information and escalate privileges via Rowhammer fault injection to the ed25519_key structure.

OSVersionArchitecturePackageVersionFilename
Debian12allwolfssl<= 5.5.4-2+deb12u1wolfssl_5.5.4-2+deb12u1_all.deb
Debian11allwolfssl<= 4.6.0+p1-0+deb11u2wolfssl_4.6.0+p1-0+deb11u2_all.deb
Debian999allwolfssl< 5.7.0-0.3wolfssl_5.7.0-0.3_all.deb
Debian13allwolfssl< 5.7.0-0.3wolfssl_5.7.0-0.3_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	wolfssl	<= 5.5.4-2+deb12u1	wolfssl_5.5.4-2+deb12u1_all.deb
Debian	11	all	wolfssl	<= 4.6.0+p1-0+deb11u2	wolfssl_4.6.0+p1-0+deb11u2_all.deb
Debian	999	all	wolfssl	< 5.7.0-0.3	wolfssl_5.7.0-0.3_all.deb
Debian	13	all	wolfssl	< 5.7.0-0.3	wolfssl_5.7.0-0.3_all.deb