Skip to content

Instantly share code, notes, and snippets.

@liang-junkai

liang-junkai/gist:3e91f58070812ea76c1b8c126c3e28c7

Created May 13, 2024 08:50
Show Gist options
  • Save liang-junkai/3e91f58070812ea76c1b8c126c3e28c7 to your computer and use it in GitHub Desktop.
Save liang-junkai/3e91f58070812ea76c1b8c126c3e28c7 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
gistfile1.txt
[NAME OF AFFECTED PRODUCT(S)]: crypto++
[AFFECTED AND/OR FIXED VERSION(S)]: 8.9
[CVE ID]: CVE-2024-28285
[PROBLEM TYPE]:
[Vulnerability Type]:Fault Injection
[Root Cause]: No check or protection in signature
[Impact]: Allows attacker to obtain sensitive information and escalate privileges
[DESCRIPTION]: A Fault Injection vulnerability in the SymmetricDecrypt function in cryptopp/elgamal.h of Cryptopp Crypto++ 8.9, allows a remote attacker to co-reside in the same system with a victim process to disclose information and escalate privileges.
[PUBLIC REFERENCES]: https://github.com/weidai11/cryptopp/issues/1262; https://groups.google.com/g/cryptopp-users/c/UkVcH2IWR2M
[DISCOVERS]: Junkai Liang, Zhi Zhang, Xin Zhang, Qingni Shen (Peking University, The University of Western Australia)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment