CVE-2024-0914: Opencryptoki RSA Timing Side-Channel Vulnerability

CVE-2024-0914 Overview

CVE-2024-0914 is a timing side-channel vulnerability in the opencryptoki package that surfaces during processing of RSA PKCS#1 v1.5 padded ciphertexts. The flaw allows an attacker to measure decryption timing differences and progressively recover plaintext or forge signatures without possessing the RSA private key. The issue is a variant of the Bleichenbacher-style oracle attack tracked under Red Hat's Project Marvin research, categorized as [CWE-203] observable discrepancy. Red Hat Enterprise Linux 8 and 9 ship affected versions of opencryptoki, a PKCS#11 implementation used to interface with hardware security modules and cryptographic tokens.

Critical Impact
A remote attacker able to submit ciphertexts and precisely measure response times can decrypt RSA-encrypted data or produce valid signatures, undermining the confidentiality of TLS sessions and cryptographic operations that depend on opencryptoki.

Affected Products

opencryptoki (upstream package, versions prior to the patched releases)
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9

Discovery Timeline

2024-01-31 - CVE-2024-0914 published to the National Vulnerability Database
2024-03-12 - Red Hat releases fix via advisory RHSA-2024:1239
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0914

Vulnerability Analysis

The vulnerability resides in how opencryptoki handles RSA decryption operations that use PKCS#1 v1.5 padding. When the library processes a ciphertext, its control flow and execution time depend on whether the decrypted padding is well-formed. An attacker measuring the response time of many chosen ciphertexts can distinguish valid from invalid PKCS#1 v1.5 structures and use that oracle to iteratively recover the plaintext or produce a valid signature. This class of attack, known as a Bleichenbacher timing oracle, has been reintroduced repeatedly across TLS stacks and cryptographic libraries; Red Hat's Project Marvin catalogs these regressions. Exploitation requires network access to a service that performs RSA PKCS#1 v1.5 decryption using the vulnerable opencryptoki backend and stable enough timing to distinguish sub-millisecond differences across many samples.

Root Cause

The root cause is a non-constant-time code path in the PKCS#1 v1.5 unpadding logic of opencryptoki. Padding validation, error propagation, and subsequent RSA operations execute along branches whose duration correlates with padding validity. Because the library did not enforce a fully constant-time implementation, the timing delta leaks side-channel information about the underlying plaintext structure.

Attack Vector

Exploitation is remote and does not require authentication or user interaction, but requires high attack complexity due to the number of oracle queries and timing precision needed. An attacker submits crafted ciphertexts to a service that calls into opencryptoki for RSA decryption, then measures response latency. Over many iterations the attacker narrows the plaintext value using Bleichenbacher's adaptive chosen-ciphertext algorithm. Deployments most at risk are those exposing opencryptoki-backed RSA operations to untrusted networks, such as TLS terminators or signing services that still permit PKCS#1 v1.5 modes.

No public proof-of-concept exploit is available. See the Red Hat Project Marvin Information page for background on the underlying attack technique.

Detection Methods for CVE-2024-0914

Indicators of Compromise

High volumes of RSA decryption or TLS handshake failures from a small set of source addresses, consistent with adaptive chosen-ciphertext probing.
Unusually long-lived connections that repeatedly send malformed ClientKeyExchange or PKCS#1 v1.5 ciphertexts against the same key.
Timing-measurement traffic patterns showing consistent request cadence targeting cryptographic endpoints.

Detection Strategies

Inventory hosts running opencryptoki and compare installed versions against the fixed releases in Red Hat CVE Analysis CVE-2024-0914.
Enable logging on services that use PKCS#11 through opencryptoki and alert on sustained decryption-error rates from single peers.
Correlate TLS server logs with network telemetry to identify oracle-style probing against RSA key exchange.

Monitoring Recommendations

Track PKCS#11 error counters and decryption failure metrics exposed by applications backed by opencryptoki.
Monitor package inventory continuously so that regressions or downgrades of opencryptoki are surfaced quickly.
Review usage of RSA PKCS#1 v1.5 across the environment and flag any service still negotiating it for TLS key exchange.

How to Mitigate CVE-2024-0914

Immediate Actions Required

Apply the vendor updates for opencryptoki shipped in RHSA-2024:1239, RHSA-2024:1411, RHSA-2024:1608, RHSA-2024:1856, and RHSA-2024:1992.
Restart every service that links against opencryptoki after patching so the updated library is loaded into memory.
Audit exposure of RSA PKCS#1 v1.5 decryption endpoints on untrusted networks and restrict access where possible.

Patch Information

Red Hat has published fixed builds of opencryptoki for Red Hat Enterprise Linux 8 and 9 through the advisories listed above. Refer to Red Hat Bug Report #2260407 for the tracking record and to the Red Hat CVE Analysis CVE-2024-0914 page for per-product fixed versions. Users of upstream opencryptoki should upgrade to the release containing the constant-time PKCS#1 v1.5 handling fix.

Workarounds

Prefer RSA-OAEP or ECDHE key exchange over RSA PKCS#1 v1.5 wherever the application stack permits.
Terminate TLS on an unaffected library and forward only application traffic to hosts that use opencryptoki.
Add network-level rate limiting to cryptographic endpoints to raise the cost of high-volume timing measurement.

bash

# Verify installed opencryptoki version and apply updates on RHEL
rpm -q opencryptoki
sudo dnf update opencryptoki
sudo systemctl restart pkcsslotd