A Fault Injection vulnerability in the SymmetricDecrypt function in cryptopp/elgamal.h of Cryptopp Crypto++ 8.9, allows an attacker to co-reside in the same system with a victim process to disclose information and escalate privileges.
The vulnerability is located in the SymmetricDecrypt function implemented in the cryptopp/elgamal.h file of the Crypto++ 8.9 library. An attacker who has access to the same system as the victim's process can perform a Fault Injection attack — intentional introduction of errors during cryptographic operations. The result is the ability to read sensitive data processed by the decryption function and obtain elevated privileges (privilege escalation).
An attacker can disclose protected cryptographic information processed by the victim's process and escalate their privileges on the system, which may lead to complete takeover of the environment.
Patches available from the vendor should be applied according to references. As an additional measure, it is recommended to isolate cryptographic processes and restrict local system access only to trusted users.
Cryptopp Crypto++ version 8.9 (cryptopp/elgamal.h file, SymmetricDecrypt function)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H