CVE catalog

CVE-2024-2881

wolfssl: CVE-2024-2881

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.46% · Oct 25, 2026

Fault Injection vulnerability in wc_ed25519_sign_msg function in wolfssl/wolfcrypt/src/ed25519.c in WolfSSL wolfssl5.6.6 on Linux/Windows allows remote attacker co-resides in the same system with a victim process to disclose information and escalate privileges via Rowhammer fault injection to the ed25519_key structure.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianwolfsslsid5.9.2-1.2fixed
Debianwolfssltrixie5.7.2-0.1+deb13u2fixed
Debianwolfsslbookworm5.5.4-2+deb12u2vulnerable
Debianwolfsslbookworm-security5.5.4-2+deb12u3vulnerable
Ubuntuwolfssl16.043.4.8+dfsg-1vulnerable
Ubuntuwolfssl18.043.10.2+dfsg-2vulnerable
Ubuntuwolfssl18.043.12.0+dfsg-1vulnerable
Ubuntuwolfssl18.043.12.2+dfsg-1vulnerable
Ubuntuwolfssl18.043.13.0+dfsg-1vulnerable
Ubuntuwolfssl20.044.1.0+dfsg-2vulnerable
Ubuntuwolfssl20.044.2.0+dfsg-1vulnerable
Ubuntuwolfssl20.044.2.0+dfsg-2vulnerable
Ubuntuwolfssl20.044.2.0+dfsg-3vulnerable
Ubuntuwolfssl20.044.3.0+dfsg-2vulnerable
Ubuntuwolfssl22.044.6.0-3vulnerable
Ubuntuwolfssl22.045.0.0-1vulnerable
Ubuntuwolfssl22.045.1.1-1vulnerable
Ubuntuwolfssl22.045.2.0-1vulnerable
Ubuntuwolfssl22.045.2.0-2vulnerable
Ubuntuwolfssl24.045.5.4-2vulnerable
Ubuntuwolfssl24.045.5.4-2.1vulnerable
Ubuntuwolfssl24.045.6.4-2vulnerable
Ubuntuwolfssl24.045.6.6-1.2vulnerable
Ubuntuwolfssl24.045.6.6-1.3vulnerable
Ubuntuwolfssl24.045.6.6-1.3build1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianwolfsslsourcesid5.7.0-0.3not yet assignedNot reportedNot reported
Debianwolfsslsourcetrixie5.7.0-0.3not yet assignedNot reportedNot reported
Debianwolfsslsourcebookworm(unfixed)not yet assignedNot reportedNot reported

Notes

[bookworm] wolfssl: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libwolfssl35]Affected

    Source package: [wolfssl]

    Details (4)

    • 5.5.4-2+deb12u2 · amd64 · bookworm

      Affected

      dsa · wolfssl · debian · bookworm; dsa · wolfssl · debian · 12

    • 5.5.4-2+deb12u2 · arm64 · bookworm

      Affected

      dsa · wolfssl · debian · bookworm; dsa · wolfssl · debian · 12

    • 5.5.4-2+deb12u3 · amd64 · bookworm-security

      Affected

      dsa · wolfssl · debian · bookworm; dsa · wolfssl · debian · 12

    • 5.5.4-2+deb12u3 · arm64 · bookworm-security

      Affected

      dsa · wolfssl · debian · bookworm; dsa · wolfssl · debian · 12

  • [libwolfssl-dev]Affected

    Source package: [wolfssl]

    Details (4)

    • 5.5.4-2+deb12u2 · amd64 · bookworm

      Affected

      dsa · wolfssl · debian · bookworm; dsa · wolfssl · debian · 12

    • 5.5.4-2+deb12u2 · arm64 · bookworm

      Affected

      dsa · wolfssl · debian · bookworm; dsa · wolfssl · debian · 12

    • 5.5.4-2+deb12u3 · amd64 · bookworm-security

      Affected

      dsa · wolfssl · debian · bookworm; dsa · wolfssl · debian · 12

    • 5.5.4-2+deb12u3 · arm64 · bookworm-security

      Affected

      dsa · wolfssl · debian · bookworm; dsa · wolfssl · debian · 12

[Debian 13 (Trixie)]

  • [libwolfssl42t64]Fixed

    Source package: [wolfssl]

    Details (2)

    • 5.7.2-0.1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 5.7.0-0.3

      dsa · wolfssl · debian · 13

    • 5.7.2-0.1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 5.7.0-0.3

      dsa · wolfssl · debian · 13

  • [libwolfssl-dev]Fixed

    Source package: [wolfssl]

    Details (2)

    • 5.7.2-0.1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 5.7.0-0.3

      dsa · wolfssl · debian · 13

    • 5.7.2-0.1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 5.7.0-0.3

      dsa · wolfssl · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]