CVE-2024-50382

What it actually does

Compiler optimization in specific LLVM versions introduces a conditional branch in GHASH computation for AES-GCM instead of constant-time XOR, creating secret-dependent control flow that may enable side-channel attacks.

Why it matters to the business

Potential compromise of encrypted communications confidentiality, requiring urgent updates to cryptographic libraries in affected environments, though low exploitability reduces immediate risk.

How an attack unfolds

An attacker with ability to observe execution timing or cache behavior on a RISC-V system compiled with Clang 15 could potentially extract authentication keys or plaintext from AES-GCM operations due to the non-constant-time implementation.

How to fix it

Upgrade Botan to the version containing commit 53b0cfde580e86b03d0d27a488b6c134f662e957 or later.

How to confirm the fix worked

Verify the commit hash in the source or check library version is at least 3.6.0 and rebuild with non-affected compilers.

Typical attack path

1. Identify target using vulnerable Botan version compiled with affected LLVM
2. Perform side-channel analysis on GHASH operations
3. Recover cryptographic secrets

How to detect it

Monitor for unusual timing variations in cryptographic operations or review build logs for affected compiler and library combinations.

What your security team should do

• Update to fixed Botan version immediately
• Audit build environments for LLVM versions
• Consider compiler flags for constant-time code