CVE-2024-54137

Executive Summary

CVE-2024-54137 is a correctness error in the reference implementation of the HQC key encapsulation mechanism (KEM) within the liboqs cryptographic library. The vulnerability stems from an indexing error that causes part of the secret key to be incorrectly treated as non-secret data. This leads to an incorrect shared secret value being returned when the decapsulation function is called with a malformed ciphertext. The flaw is classified as a high-severity issue (CVSS 7.4) and affects all versions prior to 0.12.0. While the EPSS score is currently 0.0%, indicating low exploitation likelihood, the nature of the vulnerability—affecting post-quantum cryptography implementations—makes it critical for long-term security planning. The vulnerability is fixed in liboqs version 0.12.0.

Supply Chain & Package Security

liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. It is distributed as source code and integrated into various projects. The vulnerability affects the HQC KEM implementation, which is a candidate for standardization by NIST. Organizations using liboqs for post-quantum cryptography should update to version 0.12.0 or later. The library is available on GitHub and can be integrated via package managers like vcpkg or Conan.

CVSS Breakdown & Threat Level

• CVSS Score: 7.4 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The high confidentiality impact stems from the potential exposure of secret key material due to the indexing error. The attack complexity is low, as the vulnerability can be triggered by sending a malformed ciphertext to the decapsulation function. No privileges or user interaction are required, making it exploitable remotely.

Deep Dive & Mechanics

The HQC (Hamming Quasi-Cyclic) key encapsulation mechanism is a post-quantum cryptographic algorithm that provides IND-CCA2 security. The vulnerability lies in the reference implementation of the decapsulation function. Specifically, an indexing error causes part of the secret key to be incorrectly treated as non-secret data during the decapsulation process.

When a malformed ciphertext is provided, the decapsulation function reads beyond the intended bounds of the secret key array, treating some secret key bytes as part of the ciphertext or other non-secret data. This results in an incorrect shared secret value being computed. The error is in the indexing logic that maps ciphertext components to internal data structures.

The root cause is a missing bounds check or an off-by-one error in the array indexing. This allows an attacker to craft a ciphertext that causes the decapsulation function to use secret key material as if it were part of the ciphertext, leading to a shared secret that is derived from the secret key rather than the intended encapsulation.

Vulnerable vs. Patched Code

The vulnerable code is in the HQC reference implementation, specifically in the decapsulation function. The indexing error occurs when parsing the ciphertext components.

Vulnerable Code (liboqs < 0.12.0):

// Example of vulnerable indexing in HQC decapsulation
void hqc_decaps(uint8_t *shared_secret, const uint8_t *secret_key, const uint8_t *ciphertext) {
    // ... other code ...
    // Incorrect indexing: treats part of secret_key as non-secret data
    for (int i = 0; i < HQC_CIPHERTEXT_SIZE; i++) {
        // Vulnerable: uses secret_key[i] instead of ciphertext[i] for some indices
        uint8_t val = (i < HQC_SECRET_KEY_SIZE) ? secret_key[i] : ciphertext[i - HQC_SECRET_KEY_SIZE];
        // ... process val ...
    }
    // ... rest of decapsulation ...
}

Patched Code (liboqs >= 0.12.0):

// Corrected indexing in HQC decapsulation
void hqc_decaps(uint8_t *shared_secret, const uint8_t *secret_key, const uint8_t *ciphertext) {
    // ... other code ...
    // Correct indexing: uses ciphertext for all ciphertext components
    for (int i = 0; i < HQC_CIPHERTEXT_SIZE; i++) {
        uint8_t val = ciphertext[i]; // Always read from ciphertext
        // ... process val ...
    }
    // ... rest of decapsulation ...
}

The fix ensures that the decapsulation function only reads from the ciphertext buffer for ciphertext data, preventing the secret key from being inadvertently exposed.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker would need to craft a malformed ciphertext that triggers the indexing error. The goal is to cause the decapsulation function to return a shared secret that is derived from the secret key, potentially allowing the attacker to recover secret key material.

Lab Setup:

1. Set up a test environment with liboqs version 0.11.0 or earlier.
2. Compile the library with debugging symbols enabled.
3. Write a test program that calls the HQC decapsulation function with a malformed ciphertext.

Exploit Code (Conceptual):

#include <stdio.h>
#include <string.h>
#include "hqc.h"

int main() {
    // Generate a keypair
    uint8_t public_key[HQC_PUBLIC_KEY_SIZE];
    uint8_t secret_key[HQC_SECRET_KEY_SIZE];
    hqc_keygen(public_key, secret_key);

    // Create a malformed ciphertext (e.g., all zeros)
    uint8_t ciphertext[HQC_CIPHERTEXT_SIZE];
    memset(ciphertext, 0, HQC_CIPHERTEXT_SIZE);

    // Attempt decapsulation
    uint8_t shared_secret[HQC_SHARED_SECRET_SIZE];
    int result = hqc_decaps(shared_secret, secret_key, ciphertext);

    // The shared_secret may contain secret key material due to the indexing error
    printf("Shared secret: ");
    for (int i = 0; i < HQC_SHARED_SECRET_SIZE; i++) {
        printf("%02x", shared_secret[i]);
    }
    printf("\n");

    return 0;
}

Expected Outcome: The decapsulation function returns an incorrect shared secret that is derived from the secret key, potentially leaking secret key bytes.

Blue Team

Detection:

• Monitor for unusual ciphertext patterns in network traffic that may indicate attempts to exploit this vulnerability.
• Use static analysis tools to detect the vulnerable indexing pattern in source code.
• Implement runtime checks to validate ciphertext lengths and contents before decapsulation.

Mitigation:

• Update liboqs to version 0.12.0 or later.
• Apply the patch manually if updating is not immediately possible.
• Use input validation to ensure ciphertexts are well-formed before decapsulation.

Indicators of Compromise (IOCs)

• Network: Malformed ciphertexts with unusual byte patterns that trigger the indexing error.
• Logs: Error messages from HQC decapsulation indicating incorrect shared secret values.
• File: Presence of liboqs versions prior to 0.12.0 in the software supply chain.
• Behavior: Unexpected shared secret values during key exchange operations.

Detection Engineering

YARA Rule

rule CVE_2024_54137_HQC_Indexing_Error {
    meta:
        description = "Detects vulnerable HQC decapsulation code in liboqs"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-54137"
    strings:
        $vuln_pattern = "secret_key[i]" ascii wide nocase
        $hqc_decaps = "hqc_decaps" ascii wide nocase
    condition:
        $hqc_decaps and $vuln_pattern
}

Sigma Rule

title: CVE-2024-54137 HQC Decapsulation Indexing Error
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit the HQC indexing error in liboqs
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: liboqs
detection:
    selection:
        EventID: 1001
        Message: "*hqc_decaps*"
    condition: selection
falsepositives:
    - Legitimate use of HQC decapsulation
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-54137 HQC Decapsulation Indexing Error"; flow:to_server; content:"|00 00 00 00|"; depth:4; offset:0; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Update liboqs to version 0.12.0 or later.
2. Short-term: If updating is not possible, apply the patch manually by correcting the indexing logic in the HQC decapsulation function.
3. Long-term: Implement input validation for ciphertexts before decapsulation. Use static analysis tools to detect similar indexing errors in other parts of the codebase.
4. Monitoring: Monitor for unusual ciphertext patterns and log decapsulation failures for analysis.
5. Supply Chain: Verify that all dependencies using liboqs are updated to the patched version.

Valters IT signature: This report is generated for educational and defensive purposes. Always verify with official sources.