PT-2022-26682 · Wolfssl+1 · Wolfssl+1

Berk Sunar + 4 · Published 2022-08-31 · Updated 2025-05-14 · CVE-2022-42961

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions wolfSSL versions prior to 5.5.0

Description An issue was discovered in wolfSSL that allows a fault injection attack on RAM via Rowhammer, leading to ECDSA key disclosure. Users performing signing operations with private ECC keys, such as in server-side TLS connections, might leak faulty ECC signatures. These signatures can be processed via an advanced technique for ECDSA key recovery.

Recommendations For versions prior to 5.5.0, consider using the WOLFSSL CHECK SIG FAULTS option, available in version 5.5.0 and later, to address the vulnerability. Update to version 5.5.0 or later to fully resolve the issue.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

ALT-PU-2022-2526

ALT-PU-2023-1034

CVE-2022-42961

Affected Products

Alt Linux

Wolfssl

References · 10

• https://osv.dev/vulnerability/UBUNTU-CVE-2022-42961 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-42961 · Security Note
• https://osv.dev/vulnerability/CVE-2022-42961 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-42961 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-42961 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-42961 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-42961 · Security Note
• https://github.com/wolfSSL/wolfssl/releases/tag/v5.5.0-stable · Note
• https://t.me/cibsecurity/51522 · Telegram Post
• https://t.me/cvenotify/122136 · Telegram Post