CVE-2024-1544

published 2024-08-27

CVE-2024-1544: Generating the ECDSA nonce k samples a random number r and then truncates this randomness with a modular reduction mod n where n is the order of the elliptic…

Priority P4 24 medium 4.9 CVSS 3.1

AV N AC L PR H UI N S U C H I N A N

Generating the ECDSA nonce k samples a random number r and then
truncates this randomness with a modular reduction mod n where n is the
order of the elliptic curve. Meaning k = r mod n. The division used
during the reduction estimates a factor q_e by dividing the upper two
digits (a digit having e.g. a size of 8 byte) of r by the upper digit of
n and then decrements q_e in a loop until it has the correct size.
Observing the number of times q_e is decremented through a control-flow
revealing side-channel reveals a bias in the most significant bits of
k. Depending on the curve this is either a negligible bias or a
significant bias large enough to reconstruct k with lattice reduction
methods. For SECP160R1, e.g., we find a bias of 15 bits.

Affected

9 ranges

Vendor	Product	Version range	Fixed in
debian	wolfssl	< wolfssl 5.7.2-0.1 (forky)	wolfssl 5.7.2-0.1 (forky)
msrc	azure_linux_3.0_arm	—	—
msrc	azure_linux_3.0_x64	—	—
msrc	cbl_mariner_2.0_arm	—	—
msrc	cbl_mariner_2.0_x64	—	—
wolfssl	wolfssl	< 5.7.2	5.7.2
wolfssl	wolfssl	<= 5.6.4	—
wolfssl	wolfssl	>= 0 < 5.7.2-0.1	5.7.2-0.1
wolfssl	wolfssl	>= 0 < 5.7.2-0.1	5.7.2-0.1

CVSS provenance

nvd v3.1 4.9 MEDIUM CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

osv 4.9 MEDIUM

vendor_debian 4.1 MEDIUM

vendor_msrc 4.1 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-203