CVE-2024-5288 - CVE House
Back to Database
Status published Medium CVE-2024-5288

Safe-error attack on TLS 1.3 Protocol

Vulnerability Description

An issue was discovered in wolfSSL before 5.7.0. A safe-error attack via Rowhammer, namely FAULT+PROBE, leads to ECDSA key disclosure. When WOLFSSL_CHECK_SIG_FAULTS is used in signing operations with private ECC keys, such as in server-side TLS connections, the connection is halted if any fault occurs. The success rate in a certain amount of connection requests can be processed via an advanced technique for ECDSA key recovery.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-5288

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Kemal Derya
  • M. Caner Tol
  • Berk Sunar

References

More from wolfSSL Inc.

View All →
CVE-2025-7844
wolfTPM library wrapper function `wolfTPM2_RsaKey_TpmToWolf` copies external data to a fixed-size stack buffer without length validation potentially causing stack-based buffer overflow
Low 1
CVE-2024-2873
User authentication bypass in wolfSSH server
Critical 9.1

Affected Vendor

wolfSSL Inc.

View all reports →

Affected Software

wolfSSL
Vulnerable Versions:
0

Timeline

Official Publish: August 27th, 2024
Last Modified: August 27th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-922

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.