CVE-2024-31510
📋 TL;DR
A vulnerability in Open Quantum Safe liboqs v10.0 allows remote attackers to escalate privileges via a fault injection attack on the crypto_sign_signature parameter in the ML-DSA implementation. This affects systems using liboqs for post-quantum cryptography, particularly those implementing ML-DSA signatures. Attackers could potentially forge signatures or bypass authentication mechanisms.
💻 Affected Systems
- Open Quantum Safe liboqs
📦 What is this software?
Liboqs by Openquantumsafe
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through privilege escalation leading to unauthorized access, data theft, or service disruption in systems relying on ML-DSA signatures for authentication or integrity verification.
Likely Case
Signature forgery allowing attackers to impersonate legitimate users or services, potentially bypassing authentication controls in applications using vulnerable liboqs implementations.
If Mitigated
Limited impact if systems have additional security layers, proper input validation, or don't use the vulnerable ML-DSA component in critical authentication paths.
🎯 Exploit Status
Exploitation requires fault injection capabilities (like voltage glitching or clock glitching) to manipulate the crypto_sign_signature parameter during signature generation. Public proof-of-concept demonstrates the attack methodology.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 0.10.1 or later
Vendor Advisory: https://github.com/open-quantum-safe/liboqs
Restart Required: Yes
Instructions:
1. Check current liboqs version. 2. Update to liboqs version 0.10.1 or later. 3. Recompile and relink applications using liboqs. 4. Restart affected services. 5. Verify the fix by testing signature functionality.
🔧 Temporary Workarounds
Disable vulnerable ML-DSA component
allTemporarily disable or avoid using the affected ML-DSA implementation (pqcrystals-dilithium-standard_ml-dsa-44-ipd_avx2) in liboqs
Reconfigure applications to use alternative signature algorithms not affected by this vulnerability
Implement fault injection countermeasures
allAdd hardware or software-based fault injection detection mechanisms
Implement redundant signature verification
Add checksum validation on signature parameters
🧯 If You Can't Patch
- Isolate systems using vulnerable liboqs implementation behind additional network security controls
- Implement application-level signature verification with multiple independent checks
🔍 How to Verify
Check if Vulnerable:
Check if liboqs version is 0.10.0 and if applications use the ML-DSA signature implementation. Review application code for calls to vulnerable functions.Check Version:
ldd --version | grep liboqs or check application dependencies for liboqs versionVerify Fix Applied:
Verify liboqs version is 0.10.1 or later and test signature generation/verification functionality with the ML-DSA implementation.📡 Detection & Monitoring
Log Indicators:
- Multiple failed signature verification attempts
- Unexpected signature validation errors
- Anomalous authentication patterns
Network Indicators:
- Unusual traffic patterns to services using post-quantum cryptography
- Multiple authentication requests with similar timing
SIEM Query:
source="application_logs" AND (signature_failure OR auth_failure) AND process="*liboqs*"🔗 References
- https://gist.github.com/liang-junkai/a9fc693f8bdf176e9d9f56773bf20703
- https://github.com/liang-junkai/Fault-injection-of-ML-DSA
- https://github.com/open-quantum-safe/liboqs
- https://gist.github.com/liang-junkai/a9fc693f8bdf176e9d9f56773bf20703
- https://github.com/liang-junkai/Fault-injection-of-ML-DSA
- https://github.com/open-quantum-safe/liboqs
