PT-2024-17301 · Devolutions · Devolutions.Xts.Net

Pdugre + 1 · Published 2024-11-27 · Updated 2024-11-27 · CVE-2024-11862

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Devolutions.XTS.NET versions 2024.11.19 and earlier

Description The issue concerns a non-constant time cryptographic operation, which can be exploited via timing attacks. This allows an attacker to render half of the encryption key obsolete. Successful exploitation downgrades the security guarantees of the XTS mode to those of ECB mode, enabling block swapping and identification of identical blocks. Timing attacks require specific conditions to be exploitable.

Recommendations For versions 2024.11.19 and earlier, upgrade the package to version 2024.11.26 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Galois Field multiplications in the package until a patch is applied.

Fix

Weakness Enumeration

CWE-385

Related Identifiers

CVE-2024-11862

GHSA-J6VM-4R7G-X4GR

Affected Products

Devolutions.Xts.Net

References · 7

• https://osv.dev/vulnerability/GHSA-j6vm-4r7g-x4gr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-11862 · Security Note
• https://twitter.com/CVEnew/status/1861784782448873486 · Twitter Post
• https://github.com/Devolutions/XTS.NET/commit/fb349d5bfb587218e8603b38ea37f03f036b57fd · Note
• https://github.com/Devolutions/XTS.NET · Note
• https://github.com/Devolutions/XTS.NET/security/advisories/GHSA-j6vm-4r7g-x4gr · Note
• https://twitter.com/dailycve/status/1861853943069839557 · Twitter Post