CVE-2024-37880
📋 TL;DR
This vulnerability allows attackers to recover ML-KEM 512 secret keys through timing side-channel attacks when the Kyber reference implementation is compiled with specific LLVM Clang versions and optimization flags. Systems using vulnerable Kyber implementations for post-quantum cryptography are affected, particularly those compiled with Clang 18.x or earlier with common optimization options.
💻 Affected Systems
- Kyber reference implementation
- Systems using ML-KEM 512 from vulnerable Kyber builds
📦 What is this software?
Kyber by Pq Crystals
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of encrypted communications protected by ML-KEM 512, allowing attackers to decrypt past and future messages secured with the compromised key.
Likely Case
Targeted attacks against high-value systems using vulnerable Kyber implementations, leading to data exfiltration and loss of confidentiality.
If Mitigated
Limited impact if systems use updated Kyber implementations or alternative compilation toolchains without vulnerable optimizations.
🎯 Exploit Status
Exploitation requires timing measurements and cryptographic analysis, but proof-of-concept code exists in public repositories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kyber commit 9b8d306 or later
Vendor Advisory: https://github.com/pq-crystals/kyber/commit/9b8d30698a3e7449aeb34e62339d4176f11e3c6c
Restart Required: No
Instructions:
1. Update to Kyber commit 9b8d306 or later. 2. Recompile all affected software with the patched Kyber implementation. 3. Regenerate and deploy new cryptographic keys.
🔧 Temporary Workarounds
Use alternative compiler
allCompile Kyber with GCC or other compilers instead of LLVM Clang 18.x or earlier
CC=gcc make
Disable vulnerable optimizations
allCompile with Clang flags that prevent the vulnerable optimization
CFLAGS="-O0" make
or CFLAGS="-fno-if-conversion" make
🧯 If You Can't Patch
- Monitor for unusual timing patterns in cryptographic operations
- Implement additional network segmentation for systems using vulnerable Kyber implementations
🔍 How to Verify
Check if Vulnerable:
Check Kyber commit hash: git log --oneline -1. If before 9b8d306 and compiled with Clang ≤18.x with optimizations, system is vulnerable.Check Version:
clang --version && git log --oneline -1Verify Fix Applied:
Verify Kyber commit is 9b8d306 or later: git show 9b8d306. Check compilation toolchain is not vulnerable Clang version with problematic optimizations.📡 Detection & Monitoring
Log Indicators:
- Unusual timing patterns in cryptographic operations
- Multiple failed decryption attempts with timing correlation
Network Indicators:
- Unusual network traffic patterns during key exchange operations
- Repeated connection attempts to cryptographic services
SIEM Query:
source="crypto_services" AND (operation_time > threshold OR pattern="repeated_key_exchange")🔗 References
- https://github.com/antoonpurnal/clangover
- https://github.com/pq-crystals/kyber/commit/9b8d30698a3e7449aeb34e62339d4176f11e3c6c
- https://news.ycombinator.com/item?id=40577486
- https://pqshield.com/pqshield-plugs-timing-leaks-in-kyber-ml-kem-to-improve-pqc-implementation-maturity/
- https://twitter.com/purnaltoon/status/1797644696568959476
- https://github.com/antoonpurnal/clangover
- https://github.com/pq-crystals/kyber/commit/9b8d30698a3e7449aeb34e62339d4176f11e3c6c
- https://news.ycombinator.com/item?id=40577486
- https://pqshield.com/pqshield-plugs-timing-leaks-in-kyber-ml-kem-to-improve-pqc-implementation-maturity/
- https://twitter.com/purnaltoon/status/1797644696568959476
