We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2024-50382



Assignermitre
Reserved2024-10-23
Published2024-10-23
Updated2024-10-24

Description

Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V.

References

https://github.com/randombit/botan/commit/53b0cfde580e86b03d0d27a488b6c134f662e957

https://github.com/randombit/botan/compare/3.5.0...3.6.0

https://arxiv.org/pdf/2410.13489

https://news.ycombinator.com/item?id=41887153

cve.org CVE-2024-50382

nvd.nist.gov CVE-2024-50382

Download JSON

Share this page
https://cve.threatint.com
Subscribe to our newsletter to learn more about our work.