GHSA-hvh4-5qr6-3v7r Observable Timing Discrepancy in pypqc
An attacker can recover private keys from pypqc Kyber implementations on macOS or clang-compiled systems by analyzing timing discrepancies during decapsulation requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-hvh4-5qr6-3v7r?
GHSA-hvh4-5qr6-3v7r is a vulnerability in pypqc, published on 5 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
kyber512, kyber768, and kyber1024 on Mac OS (or when compiled with clang) only: An attacker able to submit many decapsulation requests against a single private key, and to gain timing information about the decapsulation, could recover the private key. Proof-of-concept exploit exists for a local attacker.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N/E:P/RL:U/RC:C
Patches
No patch is currently available / pending upstream PQClean#556.
Workarounds
No workarounds have been reported. The 0.0.7 -> 0.0.7.1 upgrade, when available, should be a drop-in replacement<!–; it has no known breaking changes–>.
References
https://github.com/antoonpurnal/clangover
https://www.github.com/PQClean/PQClean/issues/556
https://www.github.com/pq-crystals/kyber/commit/9b8d30698a3e7449aeb34e62339d4176f11e3c6c
Which versions are affected by GHSA-hvh4-5qr6-3v7r?
2 open source packages ship an affected version, including pypqc.
| Package | Affected | Fixed in |
|---|---|---|
pypqc PyPI | From 0.0.4 to 0.0.6.2 | None |
pypqc PyPI | From 0.0.4 to 0.0.6.2 | None |
How do I fix GHSA-hvh4-5qr6-3v7r?
No fix has been published for GHSA-hvh4-5qr6-3v7r yet. Limit exposure of the affected software until one is available.
Is GHSA-hvh4-5qr6-3v7r being exploited?
There is no known exploitation of GHSA-hvh4-5qr6-3v7r in the wild and no public exploit code.