Vulnerabilities
Misconfiguration
Compliance
CVE Vulnerabilities

CVE-2024-0553

Covert Timing Channel

Published: Jan 16, 2024 | Modified: Feb 25, 2026
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.x
RedHat/V2
RedHat/V3
7.5 MODERATE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Ubuntu
MEDIUM
Vulnerability-free packages from our partners
root.io logo minimus.io logo echo.ai logo
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2024-0553
CWEhttps://cwe.mitre.org/data/definitions/385.html

A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981.

Weakness

Covert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information.

Affected Software

NameVendorStart VersionEnd Version
GnutlsGnu*3.8.3 (excluding)
Red Hat Enterprise Linux 8RedHatgnutls-0:3.6.16-8.el8_9.1*
Red Hat Enterprise Linux 8RedHatgnutls-0:3.6.16-8.el8_9.1*
Red Hat Enterprise Linux 8.6 Extended Update SupportRedHatgnutls-0:3.6.16-5.el8_6.3*
Red Hat Enterprise Linux 8.8 Extended Update SupportRedHatgnutls-0:3.6.16-7.el8_8.2*
Red Hat Enterprise Linux 9RedHatgnutls-0:3.7.6-23.el9_3.3*
Red Hat Enterprise Linux 9RedHatgnutls-0:3.7.6-23.el9_3.3*
Red Hat Enterprise Linux 9.2 Extended Update SupportRedHatgnutls-0:3.7.6-21.el9_2.2*
RHODF-4.15-RHEL-9RedHatodf4/cephcsi-rhel9:v4.15.0-37*
RHODF-4.15-RHEL-9RedHatodf4/mcg-core-rhel9:v4.15.0-68*
RHODF-4.15-RHEL-9RedHatodf4/mcg-operator-bundle:v4.15.0-158*
RHODF-4.15-RHEL-9RedHatodf4/mcg-rhel9-operator:v4.15.0-39*
RHODF-4.15-RHEL-9RedHatodf4/ocs-client-console-rhel9:v4.15.0-58*
RHODF-4.15-RHEL-9RedHatodf4/ocs-client-operator-bundle:v4.15.0-158*
RHODF-4.15-RHEL-9RedHatodf4/ocs-client-rhel9-operator:v4.15.0-13*
RHODF-4.15-RHEL-9RedHatodf4/ocs-metrics-exporter-rhel9:v4.15.0-81*
RHODF-4.15-RHEL-9RedHatodf4/ocs-operator-bundle:v4.15.0-158*
RHODF-4.15-RHEL-9RedHatodf4/ocs-rhel9-operator:v4.15.0-79*
RHODF-4.15-RHEL-9RedHatodf4/odf-cli-rhel9:v4.15.0-22*
RHODF-4.15-RHEL-9RedHatodf4/odf-console-rhel9:v4.15.0-57*
RHODF-4.15-RHEL-9RedHatodf4/odf-cosi-sidecar-rhel9:v4.15.0-6*
RHODF-4.15-RHEL-9RedHatodf4/odf-csi-addons-operator-bundle:v4.15.0-158*
RHODF-4.15-RHEL-9RedHatodf4/odf-csi-addons-rhel9-operator:v4.15.0-15*
RHODF-4.15-RHEL-9RedHatodf4/odf-csi-addons-sidecar-rhel9:v4.15.0-15*
RHODF-4.15-RHEL-9RedHatodf4/odf-multicluster-console-rhel9:v4.15.0-54*
RHODF-4.15-RHEL-9RedHatodf4/odf-multicluster-operator-bundle:v4.15.0-158*
RHODF-4.15-RHEL-9RedHatodf4/odf-multicluster-rhel9-operator:v4.15.0-10*
RHODF-4.15-RHEL-9RedHatodf4/odf-must-gather-rhel9:v4.15.0-26*
RHODF-4.15-RHEL-9RedHatodf4/odf-operator-bundle:v4.15.0-158*
RHODF-4.15-RHEL-9RedHatodf4/odf-rhel9-operator:v4.15.0-19*
RHODF-4.15-RHEL-9RedHatodf4/odr-cluster-operator-bundle:v4.15.0-158*
RHODF-4.15-RHEL-9RedHatodf4/odr-hub-operator-bundle:v4.15.0-158*
RHODF-4.15-RHEL-9RedHatodf4/odr-rhel9-operator:v4.15.0-21*
RHODF-4.15-RHEL-9RedHatodf4/rook-ceph-rhel9-operator:v4.15.0-103*
RHOL-5.8-RHEL-9RedHatopenshift-logging/cluster-logging-operator-bundle:v5.8.6-22*
RHOL-5.8-RHEL-9RedHatopenshift-logging/cluster-logging-rhel9-operator:v5.8.6-11*
RHOL-5.8-RHEL-9RedHatopenshift-logging/elasticsearch6-rhel9:v6.8.1-407*
RHOL-5.8-RHEL-9RedHatopenshift-logging/elasticsearch-operator-bundle:v5.8.6-19*
RHOL-5.8-RHEL-9RedHatopenshift-logging/elasticsearch-proxy-rhel9:v1.0.0-479*
RHOL-5.8-RHEL-9RedHatopenshift-logging/elasticsearch-rhel9-operator:v5.8.6-7*
RHOL-5.8-RHEL-9RedHatopenshift-logging/eventrouter-rhel9:v0.4.0-247*
RHOL-5.8-RHEL-9RedHatopenshift-logging/fluentd-rhel9:v5.8.6-5*
RHOL-5.8-RHEL-9RedHatopenshift-logging/log-file-metric-exporter-rhel9:v1.1.0-227*
RHOL-5.8-RHEL-9RedHatopenshift-logging/logging-curator5-rhel9:v5.8.1-470*
RHOL-5.8-RHEL-9RedHatopenshift-logging/logging-loki-rhel9:v2.9.6-14*
RHOL-5.8-RHEL-9RedHatopenshift-logging/logging-view-plugin-rhel9:v5.8.6-2*
RHOL-5.8-RHEL-9RedHatopenshift-logging/loki-operator-bundle:v5.8.6-24*
RHOL-5.8-RHEL-9RedHatopenshift-logging/loki-rhel9-operator:v5.8.6-10*
RHOL-5.8-RHEL-9RedHatopenshift-logging/lokistack-gateway-rhel9:v0.1.0-525*
RHOL-5.8-RHEL-9RedHatopenshift-logging/opa-openshift-rhel9:v0.1.0-224*
RHOL-5.8-RHEL-9RedHatopenshift-logging/vector-rhel9:v0.28.1-56*
Gnutls28Ubuntubionic*
Gnutls28Ubuntudevel*
Gnutls28Ubuntuesm-infra/focal*
Gnutls28Ubuntuesm-infra/xenial*
Gnutls28Ubuntufips-preview/jammy*
Gnutls28Ubuntufips-updates/jammy*
Gnutls28Ubuntufocal*
Gnutls28Ubuntujammy*
Gnutls28Ubuntulunar*
Gnutls28Ubuntumantic*
Gnutls28Ubuntunoble*
Gnutls28Ubuntuoracular*
Gnutls28Ubuntuplucky*
Gnutls28Ubuntuquesting*
Gnutls28Ubuntutrusty*
Gnutls28Ubuntuupstream*
Gnutls28Ubuntuxenial*

Extended Description

In some instances, knowing when data is transmitted between parties can provide a malicious user with privileged information. Also, externally monitoring the timing of operations can potentially reveal sensitive data. For example, a cryptographic operation can expose its internal state if the time it takes to perform the operation varies, based on the state. Covert channels are frequently classified as either storage or timing channels. Some examples of covert timing channels are the system’s paging rate, the time a certain transaction requires to execute, and the time it takes to gain access to a shared bus.

Potential Mitigations

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use