PT-2024-18128 · Wolfssl+1 · Wolfssl+1

Junkai Liang + 3 · Published 2024-04-04 · Updated 2026-01-27 · CVE-2024-1545

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WolfSSL version 5.6.6

Description A Fault Injection vulnerability in the RsaPrivateDecryption function in wolfssl/wolfcrypt/src/rsa.c allows a remote attacker co-residing in the same system with a victim process to disclose information and escalate privileges via Rowhammer fault injection to the RsaKey structure. This issue affects the wolfcrypt library.

Recommendations For version 5.6.6, consider disabling the RsaPrivateDecryption function as a temporary workaround until a patch is available. Restrict access to the wolfcrypt library to minimize the risk of exploitation. Avoid using the RsaKey structure in sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unchecked Return Value

Special Elements Injection

Weakness Enumeration

CWE-252

CWE-74

CWE-1256

Related Identifiers

CVE-2024-1545

Affected Products

Debian

Wolfssl

References · 16

• https://ubuntu.com/security/CVE-2024-1545 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-1545 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2024-1545 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-1545 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-1545 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-1545 · Security Note
• https://osv.dev/vulnerability/CVE-2024-1545 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-1545 · Vendor Advisory
• https://github.com/wolfSSL/wolfssl/releases/tag/v5.7.0-stable · Note
• https://github.com/wolfSSL/wolfssl/pull/7167 · Note
• https://twitter.com/VulmonFeeds/status/1776025607291228559 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1829317905411867103 · Twitter Post
• https://twitter.com/CVEnew/status/1829300362806690016 · Twitter Post
• https://t.me/cvedetector/4483 · Telegram Post
• https://docs.bell-sw.com/security/cves/CVE-2024-1545 · Note