CVE-2024-28834: Gnutls: vulnerable to minerva side-channel information leak
A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLSPRIVKEYFLAGREPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.
Other sources
Embargoed issue reported upstream:
---
My team and I have tested GnuTLS and we found that it is vulnerable to the Minerva attack. GnuTLS on its own is not vulnerable but when we are using the deterministic code we can see a step from 513 K-bit-size to 512 K-bit-size.
The test scenario is that we are signing random messages using the gnutlsprivkeysigndata2 API function using "GNUTLSPRIVKEYFLAGREPRODUCIBLE" flag. Then using the private key, we extract the K value from the signatures. After that, based on the bit size of the extracted nonce we compare full-sized nonces to smaller ones and use the statistical tests to compare the signature times.
For testing, we used gnutls-3.7.6-23.el9.x8664 and gnutls-devel-3.7.6-23.el9.x8664
In these results, we can clearly see that there is a "step" from nonce size of 513 bits to nonce size of 512 bits. The size of this side channel is around 34 ns. The sample tested has 43,190,069 observations.
Reference: https://minerva.crocs.fi.muni.cz
— Red Hat
GnuTLS could allow a remote authenticated attacker to obtain sensitive information, caused by a flaw in the ECDSA code. By utilize Minerva attack techniques, an attacker could exploit this vulnerability to obtain private key information, and use this information to launch further attacks against the affected system.
— IBM
Gnutls: vulnerable to minerva side-channel information leak
— Microsoft
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2024-28834?
CVE-2024-28834 has been classified as a significant cryptographic vulnerability due to its potential for side-channel attacks.
How do I fix CVE-2024-28834?
To fix CVE-2024-28834, upgrade to GnuTLS versions 3.6.13-2ubuntu1.11 or later for Ubuntu, or to appropriate versions provided by other distributions like Debian and Red Hat.
What systems are affected by CVE-2024-28834?
CVE-2024-28834 affects various GnuTLS implementations across different platforms, including specific versions on Ubuntu, Debian, and Red Hat.
What are the consequences of CVE-2024-28834 if exploited?
If exploited, CVE-2024-28834 can lead to information leakage through side-channel attacks, potentially compromising sensitive data.
Is there a workaround for CVE-2024-28834?
Currently, the best approach for CVE-2024-28834 is to update to the latest GnuTLS versions, as no specific workarounds are recommended.