PT-2024-31474 · Matrix+1 · Matrix Libolm+1

Soatok · Published 2024-08-22 · Updated 2024-09-10 · CVE-2024-45191

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Matrix libolm versions through 3.2.16

Description An issue was discovered in the AES implementation of Matrix libolm, which is vulnerable to cache-timing attacks due to the use of S-boxes. This vulnerability is related to software that uses a lookup table for the SubWord step and affects products that are no longer supported by the maintainer.

Recommendations For Matrix libolm versions through 3.2.16, consider switching to vodozemac as soon as possible, as it is the successor effort to libolm and is written in Rust. Users of olm-sys and its higher-level abstraction, olm-rs, are highly encouraged to make this switch. At the moment, there is no information about a newer version of Matrix libolm that contains a fix for this vulnerability.

Exploit

Fix

Weakness Enumeration

CWE-208

Related Identifiers

CVE-2024-45191

RUSTSEC-2024-0368

Affected Products

Debian

Matrix Libolm

References · 24

• 🔥 https://soatok.blog/2024/08/14/security-issues-in-matrixs-olm-library · Exploit
• https://ubuntu.com/security/CVE-2024-45191 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-45191 · Security Note
• https://gitlab.matrix.org/matrix-org/olm/-/commit/6d4b5b07887821a95b144091c8497d09d377f985 · Patch
• https://osv.dev/vulnerability/CVE-2024-45191 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-45191 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2024-0368 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45191 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-45191 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-45191 · Vendor Advisory
• https://gitlab.matrix.org/matrix-org/olm · Note
• https://t.me/cvenotify/91825 · Telegram Post
• https://t.me/cvenotify/94072 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1826700969653989548 · Twitter Post
• https://rustsec.org/advisories/RUSTSEC-2024-0368.html · Note