Skip to main content

Observable Timing Discrepancy in cloudflare/circl

Cx3111c14e-80ff

  • cloudflare/circl
  • github.com/aeonsw4n/circl
  • github.com/AeonSw4n/circl
  • github.com/afjoseph/circl
  • github.com/armfazh/circl
  • github.com/bwesterb/circl
  • github.com/cloudflare/circl
  • github.com/cloudflare/CIRCL
  • github.com/dhrubabasu/circl
  • github.com/fanym919/circl
  • github.com/thomwiggers/circl
High
7.4/10

Summary

CIRCL's Kyber cryptographic library is susceptible to a timing side-channel vulnerability, identified as "kyberslash2." This vulnerability may have an impact on certain platforms where an attacker, with the ability to precisely time the decapsulation process of Kyber on forged ciphertexts, could potentially gain access to (parts of) the secret key. It's important to note that this vulnerability does not apply to ephemeral usage scenarios, such as when Kyber is utilized in a regular manner within the context of Transport Layer Security (TLS) protocols. This issue affects github.com/cloudflare/circl versions 1.1.0 through 1.3.7.

  • HIGH
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • NONE

CWE-208 - Observable Timing Discrepancy

Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

References

Advisory Timeline

  • Published