CVE-2024-36405

2024-06-1013:15:50

CWE-208

CWE-385

[email protected]

web.nvd.nist.gov

c-language library

cryptographic algorithms

post-quantum cryptography

control-flow timing

kyber

clang

local attack

ml-kem 512

decapsulation timing

vectorized code

compiler options

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

0.0004 Low

EPSS

Percentile

15.7%

JSON

liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. A control-flow timing lean has been identified in the reference implementation of the Kyber key encapsulation mechanism when it is compiled with Clang 15-18 for -Os, -O1, and other compilation options. A proof-of-concept local attack on the reference implementation leaks the entire ML-KEM 512 secret key in ~10 minutes using end-to-end decapsulation timing measurements. The issue has been fixed in version 0.10.1. As a possible workaround, some compiler options may produce vectorized code that does not leak secret information, however relying on these compiler options as a workaround may not be reliable.

Affected configurations

Vulners

Node

open-quantum-safeliboqsRange<0.10.1

CNA Affected

[
  {
    "vendor": "open-quantum-safe",
    "product": "liboqs",
    "versions": [
      {
        "version": "< 0.10.1",
        "status": "affected"
      }
    ]
  }
]