liang-junkai

[NAME OF AFFECTED PRODUCT(S)]: liboqs
[AFFECTED AND/OR FIXED VERSION(S)]: 0.10.0
[CVE ID]: CVE-2024-31510
[PROBLEM TYPE]: 
       [Vulnerability Type]: Fault Injection
       [Root Cause]: No check or protection in signature
       [Impact]: Allows attacker to obtain sensitive information and escalate privileges
[DESCRIPTION]: An issue in Open Quantum Safe liboqs v.10.0 allows a remote attacker to escalate privileges via the crypto_sign_signature parameter in the /pqcrystals-dilithium-standard_ml-dsa-44-ipd_avx2/sign.c component.
[PUBLIC REFERENCES]: https://github.com/liang-junkai/Fault-injection-of-ML-DSA; https://github.com/open-quantum-safe/liboqs/tree/main
[DISCOVERS]: Junkai Liang, Zhi Zhang, Xin Zhang, Qingni Shen (Peking University, The University of Western Australia)

liang-junkai

[NAME OF AFFECTED PRODUCT(S)]: crypto++
[AFFECTED AND/OR FIXED VERSION(S)]: 8.9
[CVE ID]: CVE-2024-28285
[PROBLEM TYPE]: 
       [Vulnerability Type]:Fault Injection
       [Root Cause]: No check or protection in signature
       [Impact]: Allows attacker to obtain sensitive information and escalate privileges
[DESCRIPTION]: A Fault Injection vulnerability in the SymmetricDecrypt function in cryptopp/elgamal.h of Cryptopp Crypto++ 8.9, allows a remote attacker to co-reside in the same system with a victim process to disclose information and escalate privileges.
[PUBLIC REFERENCES]: https://github.com/weidai11/cryptopp/issues/1262; https://groups.google.com/g/cryptopp-users/c/UkVcH2IWR2M
[DISCOVERS]: Junkai Liang, Zhi Zhang, Xin Zhang, Qingni Shen (Peking University, The University of Western Australia)

liang-junkai

[NAME OF AFFECTED PRODUCT(S)]: relic-toolkit
[AFFECTED AND/OR FIXED VERSION(S)]: 0.6.0
[CVE ID]: CVE-2023-51939
[PROBLEM TYPE]: 
       [Vulnerability Type]:Fault Injection
       [Root Cause]: No check or protection in signature
       [Impact]: Allows attacker to obtain sensitive information and escalate privileges
[DESCRIPTION]: An issue in the cp_bbs_sig function in relic/src/cp/relic_cp_bbs.c of Relic relic-toolkit 0.6.0 allows a remote attacker to obtain sensitive information and escalate privileges via the cp_bbs_sig function.
[PUBLIC REFERENCES]: https://github.com/relic-toolkit/relic/issues/284; https://github.com/liang-junkai/Relic-bbs-fault-injection/tree/main