« Volver al listado

CVE-2024-1545

Estado: ModificadaAlta (8.8)—

Fault Injection vulnerability in RsaPrivateDecryption function in wolfssl/wolfcrypt/src/rsa.c in WolfSSL wolfssl5.6.6 on Linux/Windows allows remote attacker co-resides in the same system with a victim process to disclose information and escalate privileges via Rowhammer fault injection to the RsaKey structure.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Wolfssl — Wolfssl

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-1545",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-1545",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-30T14:19:14.904586Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "facts@wolfssl.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 1.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "facts@wolfssl.com",
      "affectedData": [
        {
          "repo": "https://github.com/wolfSSL/wolfssl",
          "vendor": "WolfSSL",
          "modules": [
            "RSA encryption system"
          ],
          "product": "wolfCrypt",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "git",
              "lessThanOrEqual": "5.6.6"
            }
          ],
          "platforms": [
            "Linux",
            "Windows",
            "64 bit",
            "32 bit"
          ],
          "packageName": "wolfssl",
          "programFiles": [
            "https://github.com/wolfSSL/wolfssl/blob/master/wolfcrypt/src/rsa.c"
          ],
          "collectionURL": "https://github.com/wolfSSL/wolfssl",
          "defaultStatus": "affected",
          "programRoutines": [
            {
              "name": "RsaPrivateDecrypt"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:wolfssl:wolfcrypt:*:*:*:*:*:*:*:*"
          ],
          "vendor": "wolfssl",
          "product": "wolfcrypt",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "git",
              "lessThanOrEqual": "5.6.6"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-08-29T23:15:10.263",
  "references": [
    {
      "url": "https://github.com/wolfSSL/wolfssl/pull/7167",
      "source": "facts@wolfssl.com"
    },
    {
      "url": "https://github.com/wolfSSL/wolfssl/releases/tag/v5.7.0-stable",
      "tags": [
        "Release Notes"
      ],
      "source": "facts@wolfssl.com"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "facts@wolfssl.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-252"
        },
        {
          "lang": "en",
          "value": "CWE-1256"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-74"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Fault Injection vulnerability in RsaPrivateDecryption function in wolfssl/wolfcrypt/src/rsa.c in WolfSSL wolfssl5.6.6 on Linux/Windows allows remote attacker co-resides in the same system with a victim process to disclose information and escalate privileges via Rowhammer fault injection to the RsaKey structure."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de inyección de fallas en la función RsaPrivateDecryption en wolfssl/wolfcrypt/src/rsa.c en WolfSSL wolfssl5.6.6 en Linux/Windows permite a un atacante remoto residir en el mismo sistema con un proceso víctima para divulgar información y escalar privilegios a través de la inyección de fallas de Rowhammer a la estructura RsaKey."
    }
  ],
  "lastModified": "2026-06-17T07:04:27.923",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wolfssl:wolfssl:5.6.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1324CF72-54B2-4CEA-A160-47EE84B56035"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "facts@wolfssl.com"
}