CVE-2024-3296

What it actually does

Timing side-channel in rust-openssl implementation of PKCS#1v1.5 RSA decryption padding allows an attacker to distinguish valid padding responses via response timing, enabling iterative plaintext recovery when a large volume of trial ciphertexts can be submitted.

Why it matters to the business

Organizations relying on legacy RSA encryption padding for confidentiality may face exposure of encrypted data such as session keys or messages if an attacker can issue many decryption queries; the issue is limited to environments still using the deprecated padding mode.

How an attack unfolds

An attacker capable of reaching the decryption oracle repeatedly crafts and submits many slightly modified ciphertexts, measures minute timing differences in responses, and uses the collected oracle feedback to gradually reconstruct the plaintext in a classic Bleichenbacher adaptive chosen-ciphertext attack.

How to fix it

Migrate away from legacy PKCS#1v1.5 RSA padding to OAEP or another authenticated padding scheme; update the rust-openssl crate to the newest release that removes or hardens the vulnerable code path and audit all code paths that still invoke the legacy decrypt function.

How to confirm the fix worked

Review source and dependency manifests for current rust-openssl version, search for any remaining calls to decrypt or private_decrypt using PKCS#1v1.5 padding, and run timing-analysis test suites against the updated library to confirm the side-channel is closed.

Typical attack path

1. Identify a service that still accepts PKCS#1v1.5-padded RSA ciphertexts for decryption
2. Establish network access sufficient to submit thousands to millions of crafted ciphertexts
3. Measure response timing for each trial ciphertext to build an oracle distinguishing valid padding
4. Iteratively narrow possible plaintext values using the timing oracle until full recovery

How to detect it

Monitor application and TLS termination logs for unusually high volumes of RSA decryption operations or error patterns consistent with padding-oracle probing; correlate with network flow data showing repeated connections from the same source to the decryption endpoint.

What your security team should do

• Immediately inventory all uses of RSA with PKCS#1v1.5 padding across services and libraries
• Prioritize migration to OAEP padding and schedule removal of legacy code paths within 30 days
• Add runtime detection for abnormally high volumes of RSA decryption requests as a compensating control
• Update rust-openssl dependency to the latest patched release in all affected projects