Security Resilience

CVE-2024-11862

Published
27 November 2024
Modified
15 April 2026
CVSS Score v4 5.1
Click a component to see what it means
Raw vectorCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0014 3th percentile
Risk Priority 28 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2024-11862 is a medium-severity Covert Timing Channel (CWE-385) vulnerability. Its CVSS base score is 5.1 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked at the 3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SC-31 (Covert Channel Analysis) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Non constant time cryptographic operation in Devolutions.XTS.NET 2024.11.19 and earlier allows an attacker to render half of the encryption key obsolete via a timing attacks

CWE(s)
CWE-385

Related Threats

MITRE ATT&CK Enterprise Techniques

T1001 Data Obfuscation Command And Control
Adversaries may obfuscate command and control traffic to make it more difficult to detect.
attack.mitre.org →
T1001.003 Protocol or Service Impersonation Command And Control
Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts.
attack.mitre.org →
T1003.001 LSASS Memory Credential Access
Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
attack.mitre.org →
T1003.002 Security Account Manager Credential Access
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored.
attack.mitre.org →
T1003.003 NTDS Credential Access
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights.
attack.mitre.org →
T1003.008 /etc/passwd and /etc/shadow Credential Access
Adversaries may attempt to dump the contents of <code>/etc/passwd</code> and <code>/etc/shadow</code> to enable offline password cracking.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-33855Shared CWE-385
CVE-2024-45192Shared CWE-385
CVE-2025-7396Shared CWE-385
CVE-2025-9231Shared CWE-385
CVE-2024-25964Shared CWE-385
CVE-2026-5598Shared CWE-385
CVE-2025-27587Shared CWE-385
CVE-2023-46809Shared CWE-385
CVE-2025-0306Shared CWE-385
CVE-2024-2236Shared CWE-385

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SC-31 Covert Channel Analysis good match

Covert channel analysis directly identifies timing channels that could leak information.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

DE.CM-09 partial match
blocks

Runtime monitoring of hardware/software behavior can detect anomalous timing patterns that indicate covert channels.

ID.RA-01 partial match
blocks

Vulnerability identification processes can surface timing-channel weaknesses during design or code analysis.

PR.PS-06 partial match
blocks

Secure development practices (reviews, testing) directly reduce introduction of timing-channel vulnerabilities in code.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.15 Logging partial match
degrades

Detailed logging can reveal timing anomalies but does not prevent covert timing channels.

A.8.16 Monitoring activities partial match
finds

Continuous monitoring may detect timing-based exfiltration but does not eliminate the channel itself.

A.8.19 Installation of software on operational systems partial match
removes
A.8.26 Application security requirements partial match
removes
A.8.27 Secure system architecture and engineering principles partial match
blocks

A.8.27 mandates establishing and applying secure-by-design principles (defense-in-depth, least privilege, zero-trust, hardening, design review) but does not stop a timing channel that remains present in the resulting implementation; the weakness can still be exploited.

A.8.28 Secure coding partial match
prevents

Secure coding guidelines may recommend constant-time algorithms but coverage is not guaranteed.

References