cve/2024/CVE-2024-36405.md

### [CVE-2024-36405](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36405)
![](https://img.shields.io/static/v1?label=Product&message=liboqs&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3C%200.10.1%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-208%3A%20Observable%20Timing%20Discrepancy&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-385%3A%20Covert%20Timing%20Channel&color=brighgreen)

### Description

liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. A control-flow timing lean has been identified in the reference implementation of the Kyber key encapsulation mechanism when it is compiled with Clang 15-18 for `-Os`, `-O1`, and other compilation options. A proof-of-concept local attack on the reference implementation leaks the entire ML-KEM 512 secret key in ~10 minutes using end-to-end decapsulation timing measurements. The issue has been fixed in version 0.10.1. As a possible workaround, some compiler options may produce vectorized code that does not leak secret information, however relying on these compiler options as a workaround may not be reliable.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/fkie-cad/nvd-json-data-feeds