5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-28834

CVE-2024-28834: A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits...

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-28834

CVE-2024-28834:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The Minerva vulnerability (CVE-2024-28834) in GnuTLS is a timing side-channel attack. It arises from the way GMP's multi-precision integers (mpz_t) are handled during the generation of deterministic nonces for ECDSA and DSA signatures, specifically when the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE (or GNUTLS_PK_FLAG_REPRODUCIBLE) flag is used. The normalization process for mpz_t objects can have variable timing based on the bit-length of the numbers, potentially leaking information about the nonce or private key.

The identified functions were vulnerable because, prior to the patch 1c4701ffc342259fc5965d5a0de90d87f780e3e5, they were central to this mpz_t-based nonce generation and usage:

_gnutls_dsa_compute_k (pre-patch) was the core function performing the nonce computation using mpz_t arithmetic, making it directly susceptible to the timing leak.
_gnutls_ecdsa_compute_k (pre-patch) was a wrapper for ECDSA that directly called the vulnerable _gnutls_dsa_compute_k, propagating the use of mpz_t for the nonce.
_wrap_nettle_pk_sign (pre-patch) orchestrated the signing process. When reproducible signatures were requested, it initialized the nonce k as an mpz_t and either called the aforementioned vulnerable functions or used rnd_mpz_func (which also dealt with mpz_t) for the Nettle backend.

The patch mitigates this vulnerability by refactoring these functions. It replaces the use of mpz_t for nonce-related calculations and representations with fixed-size mp_limb_t arrays and byte arrays (gnutls_datum_t). This change avoids the variable-time normalization operations inherent in mpz_t handling, thereby closing the timing side-channel.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.