Logic Error in Room Key Sharing of Element Android by Matrix

CVE-2021-40824

What is CVE-2021-40824?

A logic error in the room key sharing functionality of Element Android and the Matrix SDK for Android allows a malicious Matrix homeserver in an encrypted room to manipulate protocol messages. This manipulation enables the attacker to steal room encryption keys originally sent by affected Matrix clients. Consequently, the attacker gains the ability to decrypt end-to-end encrypted messages transmitted by these clients, raising significant security concerns.

References