CVE-2024-58262

A flaw was found in curve25519-dalek. The crate’s implementation of constant-time operations on elliptic curve scalars lacks proper LLVM optimization, potentially revealing information about the scalar's bits. A local attacker can observe timing differences during scalar operations. This information leak occurs via direct execution of the vulnerable code. The consequence is a potential side-channel attack.

This vulnerability is rated as having a Low impact because exploiting timing side-channels requires high attack complexity, such as local access or fine-grained execution monitoring, to extract cryptographic secret data. In Red Hat environments where this component is embedded, scalar arithmetic routines are not directly exposed to precise external timing measurements. Consequently, practical exploitation poses minimal risk under standard deployment conditions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.