PT-2024-27807 · Kyber · Kyber

Antoon Purnal · Published 2024-06-09 · Updated 2024-08-01 · CVE-2024-37880

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kyber reference implementation versions prior to 9b8d306

Description The issue is related to a timing side channel that allows attackers to recover an ML-KEM 512 secret key in minutes. This occurs because the poly frommsg function in poly.c does not prevent the compiler from emitting a vulnerable secret-dependent branch when compiled by LLVM Clang with certain optimization options.

Recommendations For versions prior to 9b8d306, consider recompiling the implementation with compiler options that prevent the emission of vulnerable secret-dependent branches, or apply other mitigation measures to prevent timing side channel attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2024-37880

Affected Products

Kyber

References · 10

• 🔥 https://github.com/antoonpurnal/clangover · Exploit
• 🔥 https://twitter.com/purnaltoon/status/1797644696568959476 · Exploit
• 🔥 https://pqshield.com/pqshield-plugs-timing-leaks-in-kyber-ml-kem-to-improve-pqc-implementation-maturity · Exploit
• https://github.com/pq-crystals/kyber/commit/9b8d30698a3e7449aeb34e62339d4176f11e3c6c · Patch
• https://osv.dev/vulnerability/CVE-2024-37880 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37880 · Security Note
• https://twitter.com/cracbot/status/1801494878347792395 · Twitter Post
• https://twitter.com/CVEnew/status/1799986411405197592 · Twitter Post
• https://news.ycombinator.com/item?id=40577486 · Note
• https://t.me/cvenotify/82511 · Telegram Post