Vulnerabilities
Misconfiguration
Compliance
CVE Vulnerabilities

CVE-2024-2236

Covert Timing Channel

Published: Mar 06, 2024 | Modified: Feb 25, 2026
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
RedHat/V2
RedHat/V3
5.9 MODERATE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Ubuntu
LOW
Vulnerability-free packages from our partners
root.io logo minimus.io logo echo.ai logo
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2024-2236
CWEhttps://cwe.mitre.org/data/definitions/385.html

A timing-based side-channel flaw was found in libgcrypts RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.

Weakness

Covert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information.

Affected Software

NameVendorStart VersionEnd Version
Red Hat Enterprise Linux 9RedHatlibgcrypt-0:1.10.0-11.el9*
Red Hat Enterprise Linux 9RedHatlibgcrypt-0:1.10.0-11.el9*
Red Hat Enterprise Linux 9.2 Extended Update SupportRedHatlibgcrypt-0:1.10.0-10.el9_2.1*
Red Hat Enterprise Linux 9.4 Extended Update SupportRedHatlibgcrypt-0:1.10.0-10.el9_4.1*
Libgcrypt11Ubuntutrusty/esm*
Libgcrypt20Ubuntufocal*
Libgcrypt20Ubuntumantic*
Libgcrypt20Ubuntuoracular*
Libgcrypt20Ubuntuplucky*

Extended Description

In some instances, knowing when data is transmitted between parties can provide a malicious user with privileged information. Also, externally monitoring the timing of operations can potentially reveal sensitive data. For example, a cryptographic operation can expose its internal state if the time it takes to perform the operation varies, based on the state. Covert channels are frequently classified as either storage or timing channels. Some examples of covert timing channels are the system’s paging rate, the time a certain transaction requires to execute, and the time it takes to gain access to a shared bus.

Potential Mitigations

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use