CVE-2024-28285

What it actually does

A fault injection vulnerability in the SymmetricDecrypt function of the ElGamal implementation in cryptopp/elgamal.h allows an attacker sharing the same physical system to induce computational errors during decryption, resulting in leakage of private key material or plaintext and subsequent privilege escalation.

Why it matters to the business

Systems relying on Crypto++ for cryptographic operations face risk of key compromise and unauthorized access when attackers achieve co-residency on shared hardware, potentially leading to data exposure and loss of system control despite low public exploit activity.

How an attack unfolds

An attacker first achieves co-residency on the same physical host as a victim process using Crypto++ 8.9, then applies hardware fault injection techniques such as voltage or electromagnetic glitching timed against ElGamal decryption calls to force observable errors that disclose secret information, ultimately using the recovered material to escalate privileges.

How to fix it

Upgrade Crypto++ to the latest version containing fixes for fault injection resistance in ElGamal operations; apply hardware-level fault detection where feasible and isolate cryptographic workloads from untrusted processes.

How to confirm the fix worked

Confirm Crypto++ version and review source for updated ElGamal handling; perform controlled fault-injection testing on decryption routines to verify absence of secret leakage under simulated faults.

Typical attack path

1. Achieve co-residency on the target physical system or host
2. Locate processes performing ElGamal decryption via Crypto++
3. Time and deliver fault injection during SymmetricDecrypt execution
4. Observe and extract leaked cryptographic material from induced faults
5. Leverage recovered keys or data for privilege escalation

How to detect it

Inspect system and application logs for anomalous cryptographic errors or repeated decryption failures on shared hosts; correlate process activity with hardware monitoring for signs of external fault attempts.

What your security team should do

• Prioritize monitoring Crypto++ updates for ElGamal fault-injection mitigations given the 2024 disclosure
• Enforce workload isolation using virtualization or containers to reduce co-residency attack surface
• Evaluate migration to cryptographic libraries with built-in fault tolerance for high-value keys