CVE-2024-1545

What it actually does

Fault injection into RsaPrivateDecryption allows an attacker sharing the same host to corrupt the RsaKey structure via Rowhammer, enabling recovery of plaintext or private key material during RSA operations.

Why it matters to the business

Successful exploitation can expose encrypted data and allow privilege escalation on systems that use WolfSSL for TLS or cryptographic services, increasing risk of data breaches in environments with shared hardware.

How an attack unfolds

An attacker with co-residency on the same Linux or Windows host triggers RSA private-key decryption in a victim WolfSSL process and uses Rowhammer to flip bits in the in-memory RsaKey structure, causing faulty computation that leaks secret information.

How to fix it

Upgrade WolfSSL to the commit 8970ff4c34034dbb3594943d11f8c9d4c5512bd5 or later; rebuild and redeploy all dependent applications; verify the updated library is loaded at runtime.

How to confirm the fix worked

Confirm the running wolfssl binary or shared library reports a commit at or after 8970ff4c34034dbb3594943d11f8c9d4c5512bd5; re-execute any internal cryptographic test suites that exercise RSA decryption paths.

Typical attack path

1. Achieve co-residency on the same physical host as the target process
2. Force or wait for the victim to perform RSA private-key decryption
3. Execute Rowhammer memory-access pattern targeting the RsaKey structure
4. Observe faulty decryption output to recover plaintext or key material
5. Escalate privileges or decrypt further traffic using recovered secrets

How to detect it

Look for unusual Rowhammer-related memory access patterns or repeated RSA decryption failures in application logs; correlate with process co-location events on shared hosts; no public exploit artifacts are known.

What your security team should do

• Prioritize patching WolfSSL instances that perform RSA private-key operations on multi-tenant or shared-hardware systems
• Isolate cryptographic workloads from untrusted code where possible
• Monitor for Rowhammer mitigation features in hardware and hypervisor configurations
• Review downstream dependents and schedule upgrades within standard change windows