CVE-2024-50383: Botan Compiler-Induced Information Disclosure

CVE-2024-50383 Overview

CVE-2024-50383 affects the Botan cryptographic library before version 3.6.0 when built with certain GCC versions on 32-bit processors. The vulnerability resides in lib/utils/donna128.h within the donna128 type used by ChaCha20-Poly1305 and X25519. Specific GCC optimization decisions produce a secret-dependent branch: an addition is skipped when a carry is not set. Researchers observed the issue with GCC 11.3.0 at -O2 on MIPS, and with GCC on x86-i386. The flaw introduces a timing side channel [CWE-203] that can leak information about cryptographic secrets.

Critical Impact
Compiler-induced secret-dependent operations in Botan's donna128 create a timing side channel that may enable recovery of key material from ChaCha-Poly1305 and X25519 operations on 32-bit builds.

Affected Products

Botan cryptographic library versions prior to 3.6.0
Applications built against Botan on 32-bit MIPS with GCC 11.3.0 -O2
Applications built against Botan on x86-i386 with affected GCC versions

Discovery Timeline

2024-10-23 - CVE-2024-50383 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-50383

Vulnerability Analysis

Botan implements a software 128-bit integer type, donna128, to support Curve25519 and ChaCha-Poly1305 arithmetic on platforms lacking a native 128-bit type. The intent of the code is fully constant time. However, when compiled with certain GCC versions on 32-bit targets, the compiler recognizes that a partial-sum addition contributes nothing when a computed carry bit is zero. GCC then emits a conditional branch that skips the addition entirely. Because the carry depends on secret operands, the branch produces observable timing variation. An attacker with access to timing measurements from ChaCha-Poly1305 or X25519 operations could infer bits of key material. Exploitation is remote but requires precise measurements and high attack complexity, and only 32-bit builds are affected.

Root Cause

The root cause is a compiler optimization that transforms branch-free arithmetic into a data-dependent branch. The original source in donna128.h unconditionally added a carry value, but GCC's optimizer recognized the mathematical equivalence of skipping the add when the carry was zero. Similar patterns existed in ghash.cpp, where R * (H1 & 1) could be folded into a conditional. The design assumption that C-level arithmetic remains constant time does not hold across all compiler and target combinations.

Attack Vector

An attacker performs a remote timing side-channel attack against a service that uses Botan for ChaCha20-Poly1305 or X25519. By collecting many timing samples across cryptographic operations, the attacker correlates observed latency with hypothesized secret bits. Successful exploitation requires the target to be a 32-bit build using a vulnerable GCC configuration and a low-noise measurement channel.

// Patch excerpt: src/lib/utils/donna128.h
#ifndef BOTAN_CURVE25519_DONNA128_H_
#define BOTAN_CURVE25519_DONNA128_H_

#include <botan/internal/ct_utils.h>
#include <botan/internal/mul128.h>
#include <type_traits>

cpp

// Patch excerpt: src/lib/utils/ghash/ghash.cpp
         m_HM[4 * j + 2 * i + 1] = H1;

         // GCM's bit ops are reversed so we carry out of the bottom
-        const uint64_t carry = R * (H1 & 1);
+        const uint64_t carry = CT::Mask<uint64_t>::expand(H1 & 1).if_set_return(R);
         H1 = (H1 >> 1) | (H0 << 63);
         H0 = (H0 >> 1) ^ carry;
      }

Source: GitHub Botan commit 53b0cfd. The fix replaces arithmetic that the compiler could turn into branches with CT::Mask value barriers that prevent GCC from introducing secret-dependent control flow.

Detection Methods for CVE-2024-50383

Indicators of Compromise

No public indicators of compromise are associated with this vulnerability; exploitation would leave no distinctive artifacts on disk.
Unusual patterns of repeated cryptographic handshakes from a single source could indicate timing-measurement probing.

Detection Strategies

Inventory applications and container images that statically or dynamically link Botan versions earlier than 3.6.0.
Identify 32-bit build targets (MIPS, i386) in continuous integration pipelines and correlate them with GCC toolchain versions.
Use software composition analysis to flag the vulnerable botan_project:botan component in dependency manifests.

Monitoring Recommendations

Monitor for anomalous volumes of TLS or Noise-protocol handshakes that use ChaCha20-Poly1305 or X25519 from a single peer.
Track outbound network telemetry from services that expose Botan-backed cryptographic endpoints for repeated short-lived sessions.
Alert on new deployments of 32-bit Botan builds in environments that were previously 64-bit only.

How to Mitigate CVE-2024-50383

Immediate Actions Required

Upgrade Botan to version 3.6.0 or later, which incorporates the value-barrier patch in donna128.h and ghash.cpp.
Rebuild and redeploy any downstream applications and container images that embed Botan.
Where upgrade is not immediately possible, migrate 32-bit deployments to 64-bit targets, which are not affected.

Patch Information

The fix is committed in GitHub Botan commit 53b0cfd and released in Botan 3.6.0. Review the Botan 3.5.0 to 3.6.0 diff to confirm patch presence. The academic analysis is available in the ArXiv research paper.

Workarounds

Build Botan on 64-bit architectures where the native 128-bit integer path is used and the vulnerable code is not exercised.
If constrained to 32-bit builds, compile with a GCC version and optimization level that does not introduce the conditional branch, verified by inspecting the generated assembly for donna128 routines.
Restrict network exposure of Botan-backed services to reduce opportunities for remote timing measurement.

bash

# Verify installed Botan version
botan version

# Build Botan 3.6.0 or later from source
curl -LO https://botan.randombit.net/releases/Botan-3.6.0.tar.xz
tar xf Botan-3.6.0.tar.xz && cd Botan-3.6.0
./configure.py --prefix=/usr/local
make -j$(nproc) && sudo make install