5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-2236

CVE-2024-2236: A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may...

A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-2236

CVE-2024-2236:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis focused on the provided diff, which implements mitigations for a timing-based side-channel vulnerability (Marvin Attack) in libgcrypt's RSA implementation. The vulnerability allows for a Bleichenbacher-style attack. Key observations from the patch:

Introduction of WITH_MARVIN_WORKAROUND preprocessor directive to gate the new mitigations.
Addition of a new PKCS#1 v1.5 decoding function _gcry_rsa_pkcs1_decode_for_enc_implicit_rejection in cipher/rsa-common.c. This function implements 'implicit rejection' by returning a synthetic message of a pseudorandomly chosen length in case of padding errors, aiming to make valid and invalid decryptions indistinguishable by timing.
Modifications to the existing _gcry_rsa_pkcs1_decode_for_enc and _gcry_rsa_oaep_decode functions in cipher/rsa-common.c to use new helper functions (e.g., mpi_to_string) and constant-time primitives (ct_* functions) for data processing.
Significant changes in the high-level rsa_decrypt function in cipher/rsa.c to incorporate the implicit rejection mechanism, including deriving a Key Derivation Key (KDK) and calling the new decoding function.
Replacement of standard MPI operations with new _sec (secure/constant-time) versions in critical paths. For example, secret_blinded in cipher/rsa.c now uses mpi_mulm_sec instead of mpi_mulm. These _sec functions are implemented in new files like mpi/mpi-mul-cs.c (mul_cs, mod_cs) and mpi/mpi-mul.c (_gcry_mpi_mul_sec, _gcry_mpi_mod_sec).

The identified vulnerable functions are those that, before the patch, processed RSA ciphertexts or performed cryptographic arithmetic in a way that leaked timing information. The patch modifies these functions to either use constant-time operations or to implement the implicit rejection strategy. rsa_decrypt is the top-level function processing the ciphertext. _gcry_rsa_pkcs1_decode_for_enc is the core PKCS#1 v1.5 padding check vulnerable to Bleichenbacher. _gcry_rsa_oaep_decode was also modified, indicating concerns for OAEP. secret_blinded and the underlying mpi_mulm it used were changed to constant-time versions, indicating they were also points of timing leakage.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.