CVE-2024-1545 Fault Injection of RSA encryption in WolfCrypt

What is CVE-2024-1545?

CVE-2024-1545 is a medium-severity vulnerability in Wolfssl Wolfssl, published on 29 Aug 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Fault Injection vulnerability in RsaPrivateDecryption function in wolfssl/wolfcrypt/src/rsa.c in WolfSSL wolfssl5.6.6 on Linux/Windows allows remote attacker co-resides in the same system with a victim process to disclose information and escalate privileges via Rowhammer fault injection to the RsaKey structure.

Weakness: CWE-74, CWE-252, CWE-1256

Which versions are affected by CVE-2024-1545?

It affects 1 product.

Products include Wolfssl Wolfssl.

How do I fix CVE-2024-1545?

Upgrade to a fixed version.

Is CVE-2024-1545 being exploited?

There is no known exploitation of CVE-2024-1545 in the wild and no public exploit code.

Other vulnerabilities in Wolfssl Wolfssl

• CVE-2024-5991 Buffer overread in domain name matching Critical 10.0
• CVE-2021-37155 Security feature bypass in n/a Critical 9.8
• CVE-2020-36177 Memory corruption in n/a Critical 9.8
• CVE-2014-2896 Memory corruption in n/a Critical 9.8
• CVE-2014-2897 Memory corruption in n/a Critical 9.8

All Wolfssl Wolfssl vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BELL-CVE-2024-1545, DEBIAN-CVE-2024-1545, GHSA-9chr-m38j-w26g, UBUNTU-CVE-2024-1545.