Cryptographic issues in wolfSSL - CVE-2024-1543

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU84842

Cryptographic issues in wolfSSL - CVE-2024-1543

Published: December 28, 2023 / Updated: September 4, 2024


Vulnerability identifier: #VU84842
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-1543
CWE-ID: CWE-310
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain access to sensitive information.

A side channel vulnerability with AES T-Tables is possible in a very controlled environment where precision sub-cache-line inspection can happen, such as inside an Intel SGX enclave. This can lead to recovery of the AES key. To prevent this type of attack, wolfSSL added an AES bitsliced implementation which can be enabled with the "--enable-aes-bitsliced" configure option.


Affected software

wolfSSL
Fedora
wolfssl
nextcloud

How to mitigate CVE-2024-1543

Install updates from vendor's website.

wolfSSL - update to 5.6.6
wolfssl - addressed in versions 5.7.2-2.el9, 5.7.2-2.fc39, 5.7.2-2.fc40, 5.7.2-2.fc41, 5.7.2-2.fc42
nextcloud - addressed in versions 29.0.5-3.el9, 29.0.5-3.fc41, 29.0.5-4.fc39, 29.0.5-4.fc40

External References

Related Security Bulletins