CVE-2024-31510

An issue in Open Quantum Safe liboqs v.10.0 allows a remote attacker to escalate privileges via the crypto_sign_signature parameter in the /pqcrystals-dilithium-standard_ml-dsa-44-ipd_avx2/sign.c component.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CISA-ADPADP
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 65%
VendorProductVersion
openquantumsafeliboqs
0.10.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
liboqs
sid
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
liboqs
noble
dne
mantic
dne
jammy
dne
focal
dne
xenial
dne
trusty
dne
Common Weakness Enumeration
References
https://gist.github.com/liang-junkai/a9fc693f8bdf176e9d9f56773bf20703
https://github.com/liang-junkai/Fault-injection-of-ML-DSA
https://github.com/open-quantum-safe/liboqs
https://gist.github.com/liang-junkai/a9fc693f8bdf176e9d9f56773bf20703
https://github.com/liang-junkai/Fault-injection-of-ML-DSA
https://github.com/open-quantum-safe/liboqs