CVE-2024-2467 Overview
CVE-2024-2467 is a timing-based side-channel vulnerability in the perl-Crypt-OpenSSL-RSA package. The flaw affects the legacy PKCS#1v1.5 RSA encryption padding mode. An attacker who can observe decryption timing across a network can mount a Bleichenbacher-style attack to recover plaintext. Successful exploitation requires sending a large number of trial ciphertexts to the target. The weakness is tracked under CWE-208: Observable Timing Discrepancy and forms part of the broader Marvin attack family documented by Red Hat.
Critical Impact
Network-based attackers can recover RSA-encrypted plaintext by measuring subtle timing variations during PKCS#1v1.5 decryption operations.
Affected Products
- perl-Crypt-OpenSSL-RSA Perl module
- Applications using PKCS#1v1.5 RSA decryption through the affected module
- Red Hat Enterprise Linux distributions shipping the vulnerable package
Discovery Timeline
- 2024-04-25 - CVE-2024-2467 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-2467
Vulnerability Analysis
The vulnerability is a classic timing side-channel exposed during RSA decryption. The perl-Crypt-OpenSSL-RSA module processes ciphertexts encoded with PKCS#1v1.5 padding. Its decryption path does not run in constant time when handling malformed or specially crafted ciphertexts. An attacker measures the response time to distinguish valid from invalid padding structures. Repeated queries allow the attacker to progressively narrow the plaintext value using Bleichenbacher's adaptive chosen-ciphertext technique. The attack is remote and does not require authentication, but the high attack complexity reflects the need for stable network timing measurements and a large volume of oracle queries.
Root Cause
The root cause is non-constant-time handling of PKCS#1v1.5 padding validation in the module's decryption routines. Any timing difference between rejecting a malformed ciphertext and processing a valid one creates a padding oracle. This defect falls under CWE-208, Observable Timing Discrepancy. The legacy PKCS#1v1.5 mode has known cryptographic weaknesses that constant-time implementations must actively mitigate.
Attack Vector
Exploitation requires network access to a service that decrypts attacker-supplied RSA ciphertexts and exposes observable timing signals. The attacker submits many crafted ciphertexts, records response latency, and uses statistical analysis to infer whether each ciphertext produced valid PKCS#1v1.5 padding after RSA decryption. Over many rounds, this reveals the underlying plaintext or session key. The technique mirrors the Marvin attack methodology documented by Red Hat researchers. See the Red Hat advisory and upstream issue #42 for technical details.
Detection Methods for CVE-2024-2467
Indicators of Compromise
- High volumes of RSA decryption requests originating from a single source or small set of sources
- Repeated requests submitting structurally similar but slightly varied ciphertext blobs
- Sustained probing of TLS or application endpoints that expose PKCS#1v1.5 RSA decryption
- Unusual latency-sensitive traffic patterns targeting services using perl-Crypt-OpenSSL-RSA
Detection Strategies
- Inventory Perl applications for use of Crypt::OpenSSL::RSA and identify code paths invoking PKCS#1v1.5 decryption
- Instrument application logs to record RSA decryption failures and their frequency per client
- Rate-limit and alert on repeated decryption errors from the same peer, a hallmark of Bleichenbacher probing
Monitoring Recommendations
- Monitor for anomalous request rates against endpoints performing RSA decryption
- Correlate TLS handshake failures and application-level padding errors across time windows
- Track outbound and inbound traffic timing anomalies to services handling sensitive key material
How to Mitigate CVE-2024-2467
Immediate Actions Required
- Update perl-Crypt-OpenSSL-RSA to a version that includes the Marvin-family timing side-channel fix
- Apply vendor patches from Red Hat and other Linux distributions shipping the module
- Audit application code and disable PKCS#1v1.5 RSA decryption where feasible
- Migrate to RSA-OAEP or authenticated encryption schemes for new deployments
Patch Information
Refer to the Red Hat CVE-2024-2467 advisory and Red Hat Bugzilla #2269567 for package updates. Upstream discussion and remediation status are tracked in GitHub issue #42. Deploy vendor-supplied packages once available for your distribution.
Workarounds
- Disable PKCS#1v1.5 RSA decryption in applications and prefer RSA-OAEP where the protocol permits
- Terminate TLS at a hardened gateway that uses a constant-time RSA implementation
- Introduce artificial jitter or strict rate limits on RSA decryption endpoints to raise attacker cost
- Rotate any RSA keys suspected of exposure to prolonged oracle probing
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
