PT-2024-40330 · Kyber · Kyber

Published 2024-06-05 · Updated 2024-06-05

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions kyber versions using kyber512, kyber768, and kyber1024 on Mac OS or when compiled with clang

Description An attacker able to submit many decapsulation requests against a single private key and gain timing information about the decapsulation could recover the private key. A proof-of-concept exploit exists for a local attacker.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-733

CWE-385

Related Identifiers

GHSA-HVH4-5QR6-3V7R

Affected Products

Kyber

References · 4

• https://osv.dev/vulnerability/GHSA-hvh4-5qr6-3v7r · Vendor Advisory
• https://github.com/PQClean/PQClean/issues/556 · Note
• https://github.com/JamesTheAwesomeDude/pypqc/security/advisories/GHSA-hvh4-5qr6-3v7r · Note
• https://github.com/JamesTheAwesomeDude/pypqc · Note