CVE-2024-50383

What it actually does

Compiler optimization on certain GCC versions for 32-bit MIPS and x86-i386 can skip an addition in the donna128 implementation when a carry flag is unset, introducing secret-dependent timing variation in ChaCha-Poly1305 and x25519 operations.

Why it matters to the business

Organizations relying on Botan for TLS, VPN, or other cryptographic services on 32-bit systems face potential exposure of long-term keys or session secrets through side-channel observation, increasing risk of data compromise until patched versions are deployed.

How an attack unfolds

An attacker with local or network access to a target process using the vulnerable donna128 routines measures timing or power side effects during ChaCha-Poly1305 or x25519 operations; repeated observations allow recovery of secret scalars or keys due to the skipped addition creating observable branches.

How to fix it

Upgrade randombit/botan to the commit 53b0cfde580e86b03d0d27a488b6c134f662e957 or later release (3.6.0+); rebuild all dependent packages and restart services that link against the library; disable 32-bit builds on affected architectures where feasible until verification.

How to confirm the fix worked

Confirm the installed Botan version is 3.6.0 or newer; inspect lib/utils/donna128.h for the corrected addition sequence; recompile with the same GCC flags and verify constant-time behavior via timing tests or binary inspection on target 32-bit platforms.

Typical attack path

1. Identify systems running Botan < 3.6.0 on 32-bit MIPS or x86-i386 with affected GCC versions
2. Trigger cryptographic operations that invoke ChaCha-Poly1305 or x25519
3. Collect high-resolution timing or microarchitectural traces during secret-dependent addition
4. Apply statistical analysis to recover secret material from observed timing variation

How to detect it

Review application and system logs for unusual cryptographic operation latency patterns or repeated connections triggering ChaCha-Poly1305/x25519; correlate with process execution of vulnerable Botan builds on 32-bit systems; no public exploit artifacts are known.

What your security team should do

• Prioritize upgrade of all Botan instances to the fixed commit within 30 days given the cryptographic nature of the flaw
• Inventory 32-bit deployments using Botan and restrict use of ChaCha-Poly1305 or x25519 until patched
• Add package version checks to build pipelines and container images to prevent reintroduction of vulnerable versions
• Monitor upstream Botan releases and rebuild policies for any downstream dependents