CVE-2024-45191
📋 TL;DR
This vulnerability in Matrix libolm's AES implementation allows attackers to perform cache-timing attacks to potentially extract cryptographic keys. It affects software using vulnerable versions of libolm for encryption, though only unsupported products are impacted. The attack requires local access or ability to measure timing differences.
💻 Affected Systems
- Matrix libolm
- Software using libolm for encryption (e.g., Matrix clients)
📦 What is this software?
Olm by Matrix
⚠️ Risk & Real-World Impact
Worst Case
Attackers could extract encryption keys, compromising confidentiality of encrypted communications in Matrix-based applications.
Likely Case
Limited impact due to requirement for precise timing measurements and local access; most real-world exploitation would be difficult.
If Mitigated
With proper network segmentation and access controls, risk is minimal as attack requires proximity to target system.
🎯 Exploit Status
Cache-timing attacks require sophisticated measurement capabilities and local system access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 6d4b5b07887821a95b144091c8497d09d377f985
Vendor Advisory: https://gitlab.matrix.org/matrix-org/olm/
Restart Required: Yes
Instructions:
1. Update to latest libolm version or apply commit 6d4b5b07887821a95b144091c8497d09d377f985
2. Rebuild and reinstall libolm
3. Restart applications using libolm
4. Consider migrating to vodozemac (recommended replacement)
🔧 Temporary Workarounds
Migrate to vodozemac
allReplace libolm with vodozemac, the recommended replacement library
Follow migration guide at https://gitlab.matrix.org/matrix-org/olm/-/blob/master/docs/migrating.md
🧯 If You Can't Patch
- Implement strict access controls to limit local system access
- Monitor for unusual timing analysis tools or processes on affected systems
🔍 How to Verify
Check if Vulnerable:
Check libolm version; if ≤3.2.16 and using AES implementation, system is vulnerableCheck Version:
Check package manager or compile logs for libolm versionVerify Fix Applied:
Verify libolm version is >3.2.16 or includes commit 6d4b5b07887821a95b144091c8497d09d377f985📡 Detection & Monitoring
Log Indicators:
- Unusual process timing measurements
- Suspicious cryptographic operations
Network Indicators:
- Unusual local network traffic patterns for timing analysis
SIEM Query:
Process execution of timing measurement tools on systems with libolm