CVE-2024-2881
Wolfssl 5.6.6
Raw vector
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:LSummary
CVE-2024-2881 is a medium-severity Unchecked Return Value (CWE-252) vulnerability in Wolfssl Wolfssl. Its CVSS base score is 6.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-27825
Vulnerability Data
Fault Injection vulnerability in wc_ed25519_sign_msg function in wolfssl/wolfcrypt/src/ed25519.c in WolfSSL wolfssl5.6.6 on Linux/Windows allows remote attacker co-resides in the same system with a victim process to disclose information and escalate privileges via Rowhammer fault injection to the ed25519_key structure.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V11.2.5V1.2.1V1.2.3V1.2.5
Mitigating Controls (NIST 800-53 r5) AI
Access enforcement directly stops unauthorized software from reaching hardware registers or side-channel interfaces.
Least privilege restricts which processes may invoke power/clock or other hardware-control functions.
Least functionality disables or removes unnecessary software interfaces that expose hardware features.
Developer testing and code evaluation can discover instances where return values are ignored.
Hardware-enforced write protection and procedures limit software modification of protected hardware bits.
SI-10 directly requires validation of information inputs to reject malformed or special-element content before it reaches downstream parsers.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require checking and handling all function return values to detect error conditions.
ID.RA-01 can surface the hardware-interface flaw during architecture review or testing (partial forward) but supplies no design or implementation restrictions that actually eliminate the root weakness (none reverse).
PR.PS-01's least-functionality baselines can partially limit exposure to risky hardware interfaces when they are configurable, but CWE-1256 is a design-level failure to implement proper restrictions that config management alone does not prevent.
ID.AM-08's generic lifecycle-management guidance has no direct bearing on hardware-interface restriction defects, so neither direction removes or mitigates CWE-1256.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure coding practices can enforce input validation and capability checks on hardware-control APIs, reducing the likelihood of unintended register or memory changes.
Security testing in development and acceptance can detect missing return-value checks.
Logging supports detection of injection attempts but does not prevent the weakness.
Monitoring activities can identify active injection attacks after they occur.
Restricting privileged utility programs limits exposure of low-level hardware interfaces that could be abused for memory or register manipulation.
Privileged access rights limit who can invoke hardware-control interfaces, reducing the attack surface for unauthorized register/memory manipulation.