Ubuntu.comUB:CVE-2024-5288CVE-2024-5288
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
AI Score
Confidence
Low
An issue was discovered in wolfSSL before 5.7.0. A safe-error attack via
Rowhammer, namely FAULT+PROBE, leads to ECDSA key disclosure. When
WOLFSSL_CHECK_SIG_FAULTS is used in signing operations with private ECC
keys,
such as in server-side TLS connections, the connection is halted if any
fault occurs. The success rate in a certain amount of connection requests
can be processed via an advanced technique for ECDSA key recovery.
Related
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
AI Score
Confidence
Low