CVE-2024-36405

Executive Summary

CVE-2024-36405 is a timing side-channel vulnerability in the reference implementation of the Kyber key encapsulation mechanism (KEM) within the liboqs cryptographic library. The flaw allows a local attacker to recover the entire ML-KEM 512 secret key in approximately 10 minutes by measuring end-to-end decapsulation timing. The vulnerability is present in liboqs versions prior to 0.10.1 and is triggered when the library is compiled with Clang 15-18 using optimization flags -Os, -O1, and other similar options. The CVSS score is 5.9 (Medium), with a local attack vector and low attack complexity. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the proof-of-concept is public, making it a credible threat for targeted attacks.

Supply Chain & Package Security

liboqs is a C-language library that provides implementations of post-quantum cryptography algorithms. It is used as a dependency in various open-source projects and cryptographic tools. The vulnerability affects the reference implementation of Kyber, which is a finalist in the NIST post-quantum cryptography standardization process. Organizations using liboqs in their supply chain should verify their version and apply the patch immediately. The library is distributed via GitHub and may be included in package managers for C/C++ projects.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 5.9 (Medium)
• Attack Vector: Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – The attack does not require special conditions.
• Privileges Required: None (PR:N) – No privileges are needed to perform the timing measurements.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality: High (C:H) – Full secret key recovery is possible.
• Integrity: None (I:N) – No data integrity impact.
• Availability: None (A:N) – No availability impact.

Threat Level: Medium. The attack requires local access and specific compiler/optimization conditions, but the proof-of-concept is public and the attack is fast (~10 minutes).

Deep Dive & Mechanics

The vulnerability is a control-flow timing leak in the reference implementation of the Kyber KEM. When compiled with Clang 15-18 using optimization flags -Os, -O1, or similar, the compiler generates code where the execution time of the decapsulation function depends on secret key material. Specifically, the timing variation arises from conditional branches that are not constant-time, allowing an attacker to infer bits of the secret key through precise timing measurements.

The attack works as follows:

1. The attacker sends a series of ciphertexts to the target system for decapsulation.
2. The attacker measures the time taken for each decapsulation operation.
3. By analyzing the timing variations, the attacker can reconstruct the secret key.

The proof-of-concept demonstrates full ML-KEM 512 secret key recovery in approximately 10 minutes using end-to-end decapsulation timing measurements. The vulnerability is specific to the reference implementation and does not affect optimized or hardware-backed implementations.

Vulnerable vs. Patched Code

The vulnerable code is in the reference implementation of Kyber decapsulation. The timing leak is due to non-constant-time conditional branches. The patch in version 0.10.1 replaces these branches with constant-time alternatives.

Vulnerable Code (simplified):

// Vulnerable: timing depends on secret data
if (secret_bit) {
    // branch A
} else {
    // branch B
}

Patched Code (simplified):

// Patched: constant-time using bitwise operations
result = (secret_bit & branch_a) | ((~secret_bit) & branch_b);

The exact patch can be found in the liboqs GitHub repository at commit 0.10.1.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to the target system.
• liboqs version < 0.10.1 compiled with Clang 15-18 using -Os, -O1, or similar.
• Ability to send ciphertexts and measure decapsulation timing.

Exploitation Steps:

1. Compile the vulnerable liboqs with Clang 15-18 and -Os or -O1.
2. Run the Kyber KEM decapsulation function on the target.
3. Use the public proof-of-concept script to send ciphertexts and collect timing measurements.
4. Analyze the timing data to recover the secret key.

Proof-of-Concept (simplified):

import time
import liboqs

kem = liboqs.KeyEncapsulation('Kyber512')
public_key = kem.generate_keypair()
secret_key = kem.export_secret_key()

# Attacker sends ciphertexts and measures timing
for i in range(1000):
    ciphertext, _ = kem.encaps(public_key)
    start = time.perf_counter()
    shared_secret = kem.decaps(ciphertext)
    end = time.perf_counter()
    timing = end - start
    # Store timing for analysis

Blue Team

Detection:

• Monitor for unusual patterns of decapsulation operations (high frequency).
• Use timing analysis tools to detect anomalous execution times.
• Check for compilation flags that may trigger the vulnerability.

Mitigation:

• Update liboqs to version 0.10.1 or later.
• If patching is not possible, use compiler options that produce vectorized code (e.g., -O2 or -O3 with Clang) as a workaround, but note this may not be reliable.
• Use hardware-backed or constant-time implementations of Kyber.

Indicators of Compromise (IOCs)

• File Hashes:
  • Vulnerable liboqs library (SHA256): e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example)
• Network Indicators:
  • Unusual frequency of decapsulation requests from a single source.
• Behavioral Indicators:
  • High CPU usage during decapsulation operations.
  • Repeated calls to the decapsulation function with different ciphertexts.

Detection Engineering

YARA Rule

rule CVE_2024_36405_liboqs_timing_leak {
    meta:
        description = "Detects vulnerable liboqs Kyber implementation with timing leak"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-36405"
    strings:
        $vuln_func = "kyber512_ref_decaps" ascii wide nocase
        $vuln_compile = "-Os" ascii wide nocase
    condition:
        $vuln_func and $vuln_compile
}

Sigma Rule

title: CVE-2024-36405 - Timing Side-Channel in liboqs Kyber
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation of timing leak in liboqs Kyber decapsulation
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/liboqs.so'
        CommandLine|contains: '-Os'
    condition: selection
falsepositives:
    - Legitimate use of liboqs with -Os flag
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-36405 - liboqs Kyber Timing Attack"; flow:to_server; content:"|00 01 02 03|"; depth:4; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update liboqs to version 0.10.1 or later.
2. If patching is not possible, recompile with -O2 or -O3 using Clang 15-18, but note this may not fully mitigate the issue.
3. Use hardware-backed or constant-time implementations of Kyber.

Long-Term Measures:

• Implement constant-time coding practices in cryptographic libraries.
• Use compiler flags that enforce constant-time execution (e.g., -fno-jump-tables).
• Conduct regular security audits of cryptographic implementations.

Workarounds:

• Some compiler options may produce vectorized code that does not leak secret information, but relying on these is not recommended.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert