CVE-2024-11862
Devolutions.XTS.NET Vulnerable to Timing Attack on GF Multiplications
Non constant time cryptographic operation in Devolutions.XTS.NET 2024.11.19 and earlier allows an attacker to render half of the encryption key obsolete via a timing attacks
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Non constant time cryptographic operation in Devolutions.XTS.NET 2024.11.19 and earlier allows an attacker to render half of the encryption key obsolete via a timing attacks
- Record
CVE-2024-11862- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-385
- Updated
- 2026-11-02
EUVDEUVD-2024-3394
Non constant time cryptographic operation in Devolutions.XTS.NET 2024.11.19 and earlier allows an attacker to render half of the encryption key obsolete via a timing attacks
- Record
EUVD-2024-3394- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j6vm-4r7g-x4gr
Devolutions.XTS.NET Vulnerable to Timing Attack on GF Multiplications
Impact
Timing attacks on Galois Field multiplications in this package. Successful exploitation would effectively allow a downgrade of the security guarantees of the XTS mode to the security guarantees of ECB mode, allowing block swapping, enabling identification of identical blocks, and rendering half of the XTS key obsolete. Timing attacks require specific conditions to be exploitable.
Patches
Patched in 2024.11.26
Workarounds
Upgrade the package
References
- Record
GHSA-j6vm-4r7g-x4gr- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-385
- Updated
- 2026-11-02
NVD
Non constant time cryptographic operation in Devolutions.XTS.NET 2024.11.19 and earlier allows an attacker to render half of the encryption key obsolete via a timing attacks
- Record
CVE-2024-11862- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-385
- Updated
- 2026-11-02
OSVGHSA-j6vm-4r7g-x4gr
Devolutions.XTS.NET Vulnerable to Timing Attack on GF Multiplications
Impact
Timing attacks on Galois Field multiplications in this package. Successful exploitation would effectively allow a downgrade of the security guarantees of the XTS mode to the security guarantees of ECB mode, allowing block swapping, enabling identification of identical blocks, and rendering half of the XTS key obsolete. Timing attacks require specific conditions to be exploitable.
Patches
Patched in 2024.11.26
Workarounds
Upgrade the package
References
- Record
GHSA-j6vm-4r7g-x4gr- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-385
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
Devolutions.XTS.NETNuGet |
before 2024.11.26 | 2024.11.26 |
Devolutions.XTS.NETNuGet |
before 2024.11.26, plus listed versions 2024.11.19 |
2024.11.26 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-11862 is a medium vulnerability (CVSS 5.1) in Devolutions Xts.net, published November 27, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 3rd percentile. Fixed in Devolutions.XTS.NET 2024.11.26.