Linux Distros Unpatched Vulnerability : CVE-2019-14317

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wolfSSL and wolfCrypt 4.1.0 and earlier formerly known as CyaSSL generate biased DSA nonces. This allows a remote attacker to compute the long term private key...

Linux Distros Unpatched Vulnerability : CVE-2019-13628

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wolfSSL and wolfCrypt 4.0.0 and earlier when configured without --enable-fpecc, --enable-sp, or --enable- sp-math contain a timing side channel in ECDSA signatu...

CVE-2019-14317

wolfSSL and wolfCrypt 4.1.0 and earlier formerly known as CyaSSL generate biased DSA nonces. This allows a remote attacker to compute the long term private key from several hundred DSA signatures via a lattice attack. The issue occurs because dsa.c fixes two bits of the generated nonces...

CVE-2024-1545

...

CVE-2024-2881: Improper Restriction of Software Interfaces to Hardware Features

Fault Injection vulnerability in wced25519signmsg function in wolfssl/wolfcrypt/src/ed25519.c in WolfSSL wolfssl5.6.6 on Linux/Windows allows remote attacker co-resides in the same system with a victim process to disclose information and escalate privileges via Rowhammer fault injection to the...

DEBIAN-CVE-2024-1545

Fault Injection vulnerability in RsaPrivateDecryption function in wolfssl/wolfcrypt/src/rsa.c in WolfSSL wolfssl5.6.6 on Linux/Windows allows remote attacker co-resides in the same system with a victim process to disclose information and escalate privileges via Rowhammer fault injection to the...

CVE-2024-2881 Fault Injection of EdDSA signature in WolfCrypt

Fault Injection vulnerability in wced25519signmsg function in wolfssl/wolfcrypt/src/ed25519.c in WolfSSL wolfssl5.6.6 on Linux/Windows allows remote attacker co-resides in the same system with a victim process to disclose information and escalate privileges via Rowhammer fault injection to the...

CVE-2024-2881 Fault Injection of EdDSA signature in WolfCrypt

Fault Injection vulnerability in wced25519signmsg function in wolfssl/wolfcrypt/src/ed25519.c in WolfSSL wolfssl5.6.6 on Linux/Windows allows remote attacker co-resides in the same system with a victim process to disclose information and escalate privileges via Rowhammer fault injection to the...

CVE-2024-1545 Fault Injection of RSA encryption in WolfCrypt

Fault Injection vulnerability in RsaPrivateDecryption function in wolfssl/wolfcrypt/src/rsa.c in WolfSSL wolfssl5.6.6 on Linux/Windows allows remote attacker co-resides in the same system with a victim process to disclose information and escalate privileges via Rowhammer fault injection to the...

CVE-2024-1545 Fault Injection of RSA encryption in WolfCrypt

Fault Injection vulnerability in RsaPrivateDecryption function in wolfssl/wolfcrypt/src/rsa.c in WolfSSL wolfssl5.6.6 on Linux/Windows allows remote attacker co-resides in the same system with a victim process to disclose information and escalate privileges via Rowhammer fault injection to the...

PT-2024-18128

Name of the Vulnerable Software and Affected Versions WolfSSL version 5.6.6 Description A Fault Injection vulnerability in the RsaPrivateDecryption function in wolfssl/wolfcrypt/src/rsa.c allows a remote attacker co-residing in the same system with a victim process to disclose information and...

cryptofuzz:cryptofuzz-boringssl-noasm: Use-of-uninitialized-value in cryptofuzz::module::wolfCrypt_bignum::Bignum::~Bignum

Project: https://github.com/guidovranken/cryptofuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=6447297799979008 Project: cryptofuzz Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-boringssl-noasm Job Type: libfuzzermsancryptofuzz Platform Id: linux Crash Type:...

cryptofuzz:cryptofuzz-boringssl-noasm: Use-of-uninitialized-value in sp_radix_size

Project: https://github.com/guidovranken/cryptofuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=6016941506494464 Project: cryptofuzz Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-boringssl-noasm Job Type: libfuzzermsancryptofuzz Platform Id: linux Crash Type:...

cryptofuzz:cryptofuzz-boringssl: Crash in wc_ecc_verify_hash_ex

Project: https://github.com/guidovranken/cryptofuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5433015341023232 Project: cryptofuzz Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-boringssl Job Type: libfuzzerubsancryptofuzz Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address...

cryptofuzz:cryptofuzz-boringssl-noasm: Stack-buffer-overflow in wc_AesGcmInit

Project: https://github.com/guidovranken/cryptofuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=4793621217148928 Project: cryptofuzz Fuzzing Engine: afl Fuzz Target: cryptofuzz-boringssl-noasm Job Type: aflasancryptofuzz Platform Id: linux Crash Type: Stack-buffer-overflow WRITE Crash...

cryptofuzz:cryptofuzz-boringssl-noasm: Crash in Sha3Final

Project: https://github.com/guidovranken/cryptofuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5573556058062848 Project: cryptofuzz Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-boringssl-noasm Job Type: libfuzzerubsancryptofuzz Platform Id: linux Crash Type: UNKNOWN WRITE Crash...

cryptofuzz:cryptofuzz-boringssl-noasm: Crash in wc_Sha3_224_Final

Project: https://github.com/guidovranken/cryptofuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5141568985628672 Project: cryptofuzz Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-boringssl-noasm Job Type: libfuzzerasancryptofuzz Platform Id: linux Crash Type: UNKNOWN Crash Address:...

cryptofuzz:cryptofuzz-boringssl-noasm: Stack-buffer-overflow in wc_Sha3_512_Final

Project: https://github.com/guidovranken/cryptofuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5049072880320512 Project: cryptofuzz Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-boringssl-noasm Job Type: libfuzzerasancryptofuzz Platform Id: linux Crash Type: Stack-buffer-overflow...

cryptofuzz:cryptofuzz-boringssl-noasm: Use-of-uninitialized-value in wc_ecc_export_x963_ex

Project: https://github.com/guidovranken/cryptofuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5334526317953024 Project: cryptofuzz Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-boringssl-noasm Job Type: libfuzzermsancryptofuzz Platform Id: linux Crash Type:...

wolfCrypt leaks cryptographic information via timing side channel

wolfSSL and wolfCrypt 4.0.0 and earlier when configured without --enable-fpecc, --enable-sp, or --enable-sp-math contain a timing side channel in ECDSA signature generation. This allows a local attacker, able to precisely measure the duration of signature operations, to infer information about th...