CVE-2024-5288

CVE-2024-5288 affects wolfSSL before 5.7.0. A safe-error attack via Rowhammer (FAULT+PROBE) can lead to disclosure of ECDSA private keys, particularly when WOLFSSL_CHECK_SIG_FAULTS is used during signing in server TLS. The attack’s success is described in the vulnerability details and is mitigate...

CVE-2024-5288

An issue was discovered in wolfSSL before 5.7.0. A safe-error attack via Rowhammer, namely FAULT+PROBE, leads to ECDSA key disclosure. When WOLFSSLCHECKSIGFAULTS is used in signing operations with private ECC keys, such as in server-side TLS connections, the connection is halted if any fault...

CVE-2024-5288 Safe-error attack on TLS 1.3 Protocol

An issue was discovered in wolfSSL before 5.7.0. A safe-error attack via Rowhammer, namely FAULT+PROBE, leads to ECDSA key disclosure. When WOLFSSLCHECKSIGFAULTS is used in signing operations with private ECC keys, such as in server-side TLS connections, the connection is halted if any fault...

CVE-2024-5991

In function MatchDomainName, input param str is treated as a NULL terminated string despite being user provided and unchecked. Specifically, the function X509checkhost takes in a pointer and length to check against, with no requirements that it be NULL terminated. If a caller was attempting to do...

CVE-2024-5991

CVE-2024-5991 describes a buffer overread in wolfSSL’s domain-name matching. The vulnerability arises when MatchDomainName() treats the input as NULL-terminated even though X509_check_host() accepts a pointer+length without requiring NULL termination, allowing a caller providing a non-NULL-termin...

CVE-2024-5991 Buffer overread in domain name matching

In function MatchDomainName, input param str is treated as a NULL terminated string despite being user provided and unchecked. Specifically, the function X509checkhost takes in a pointer and length to check against, with no requirements that it be NULL terminated. If a caller was attempting to do...

CVE-2024-5991 Buffer overread in domain name matching

In function MatchDomainName, input param str is treated as a NULL terminated string despite being user provided and unchecked. Specifically, the function X509checkhost takes in a pointer and length to check against, with no requirements that it be NULL terminated. If a caller was attempting to do...

CVE-2024-5991 Buffer overread in domain name matching

In function MatchDomainName, input param str is treated as a NULL terminated string despite being user provided and unchecked. Specifically, the function X509checkhost takes in a pointer and length to check against, with no requirements that it be NULL terminated. If a caller was attempting to do...

CVE-2024-5991

In function MatchDomainName, input param str is treated as a NULL terminated string despite being user provided and unchecked. Specifically, the function X509checkhost takes in a pointer and length to check against, with no requirements that it be NULL terminated. If a caller was attempting to do...

CVE-2024-5991

In function MatchDomainName, input param str is treated as a NULL terminated string despite being user provided and unchecked. Specifically, the function X509checkhost takes in a pointer and length to check against, with no requirements that it be NULL terminated. If a caller was attempting to do...

wolfSSL 安全漏洞

wolfSSL CyaSSL is the United States wolfSSL company for embedded systems developers to use a small, portable embedded SSL programming library. WolfSSL suffers from an out-of-bounds read vulnerability that stems from the failure to check user input in the MatchDomainName function, which can be...

wolfSSL 安全漏洞

wolfSSL CyaSSL is a small, portable embedded SSL programming library for use by embedded systems developers from wolfSSL, Inc. in the United States. A security vulnerability exists in wolfSSL that stems from the fact that a malicious TLS1.2 server can force a TLS1.3 client with degradation...

wolfSSL 安全漏洞

wolfSSL CyaSSL is the United States wolfSSL company for embedded systems developers to use a small, portable embedded SSL programming library. A security vulnerability exists in wolfSSL prior to version 5.7.2, which stems from the use of insufficiently randomized random numbers when generating...

CVE-2024-5288: Insecure Storage of Sensitive Information

An issue was discovered in wolfSSL before 5.7.0. A safe-error attack via Rowhammer, namely FAULT+PROBE, leads to ECDSA key disclosure. When WOLFSSLCHECKSIGFAULTS is used in signing operations with private ECC keys, such as in server-side TLS connections, the connection is halted if any fault...

wolfSSL 安全漏洞

wolfSSL CyaSSL is the United States wolfSSL company for embedded systems developers to use a small, portable embedded SSL programming library. A security vulnerability exists in wolfSSL versions prior to 5.7.0, which can be exploited by an attacker to cause ECDSA key disclosure...

CVE-2024-5991: Out-of-bounds Read

In function MatchDomainName, input param str is treated as a NULL terminated string despite being user provided and unchecked. Specifically, the function X509checkhost takes in a pointer and length to check against, with no requirements that it be NULL terminated. If a caller was attempting to do...

wolfssl:cryptofuzz-heapmath: Use-of-uninitialized-value in Botan::operator-

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=4852748728729600 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-heapmath Job Type: libfuzzermsanwolfssl Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

wolfssl:cryptofuzz-normal-math: Use-of-uninitialized-value in Botan::IntMod<Botan::PCurve::Secp256r1Rep<Botan::EllipticCurve<Botan::PCurve::se

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5851619005104128 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-normal-math Job Type: libfuzzermsanwolfssl Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address...

wolfssl:cryptofuzz-normal-math: Use-of-uninitialized-value in Botan::ProjectiveCurvePoint<Botan::IntMod<Botan::PCurve::secp256k1::Secp256k1Rep

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5355196484485120 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-normal-math Job Type: libfuzzermsanwolfssl Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address...

PT-2024-6326

Name of the Vulnerable Software and Affected Versions WolfSSL affected versions not specified Description A malicious TLS1.2 server can force a TLS1.3 client with downgrade capability to use a ciphersuite that it did not agree to and achieve a successful connection. This is because, aside from th...