Cloudanix VulnDB

CVE-2021-4239

High · 7.5

CVSS

7.5

EPSS

0.4%

Published

Dec 27, 2022

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in message encryption handling can eventually let attackers weaken protection or disrupt service after an enormous number of messages are exchanged.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Theoretical
Impact
Data Tampering
Component
Library
Class
Cryptographic Weakness
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

After encrypting 2^64 messages the nonce counter wraps causing reuse of the same key and nonce; additionally the Decrypt function advances the nonce even on failure, allowing an attacker-supplied invalid message to desynchronize peers and prevent all subsequent encryption.

Why it matters to the business

Long-lived encrypted sessions in affected GitLab deployments may eventually lose confidentiality or integrity protections and become unavailable, though the low EPSS and multi-year age reduce immediate operational risk.

How an attack unfolds

An attacker establishes a long-lived Noise session, sends exactly 2^64 encrypted messages to trigger nonce wrap-around, or supplies crafted invalid ciphertexts to the Decrypt function to force nonce desynchronization and subsequent encryption failure.

How to fix it

Upgrade gitlab-org/gitlab to one of the fixed commits: 0b24f0547393a5606b1ec7e4e31cfeab4bce5cab, 7b2ed8f038f6184c0485cdae8d97c9f579454ffc.

How to confirm the fix worked

Verify the running GitLab binary or source tree contains one of the listed fixed commits; re-test nonce behavior under high message counts and invalid decrypt inputs in a lab environment.

Typical attack path

  1. Establish a Noise-protocol session with the target GitLab instance
  2. Transmit 2^64 valid encrypted messages to induce nonce reuse
  3. Alternatively send malformed ciphertexts to the Decrypt path to desynchronize nonces
  4. Observe subsequent messages being encrypted with duplicate key/nonce pairs or complete encryption failure

How to detect it

Review application and cryptographic library logs for sudden spikes in decrypt failures followed by encryption errors; look for session resets or repeated nonce-related warnings in Noise protocol implementations.

What your security team should do

  • Apply the listed GitLab commits immediately on all production instances
  • Monitor EPSS trend and re-evaluate if exploit maturity changes
  • Add runtime checks that reset or alert on nonce values approaching 2^64

The record

The Noise protocol implementation suffers from weakened cryptographic security after encrypting 2^64 messages, and a potential denial of service attack. After 2^64 (~18.4 quintillion) messages are encrypted with the Encrypt function, the nonce counter will wrap around, causing multiple messages to be encrypted with the same key and nonce. In a separate issue, the Decrypt function increments the nonce state even when it fails to decrypt a message. If an attacker can provide an invalid input to the Decrypt function, this will cause the nonce state to desynchronize between the peers, resulting in a failure to encrypt all subsequent messages.

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/flynn/noise 0 1.0.0
Ubuntu:22.04:LTS golang-github-flynn-noise 0 No fix
Ubuntu:24.04:LTS golang-github-flynn-noise 0 No fix
Ubuntu:24.10 golang-github-flynn-noise 0 No fix
Ubuntu:25.04 golang-github-flynn-noise 0 No fix
Ubuntu:25.10 golang-github-flynn-noise 0 No fix

Related vulnerabilities