PT-2013-1070 · Gnu+3 · Libgcrypt+4
Katrina Falkner
+1
·
Published
2013-08-03
·
Updated
2024-06-15
·
CVE-2013-4242
CVSS v2.0
1.9
Low
| Vector | AV:L/AC:M/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
libgcrypt versions 1.4.4 through 1.4.5
libgcrypt-devel versions 1.4.4 through 1.4.5
libgcrypt-debuginfo versions 1.4.4 through 1.4.5
GnuPG versions prior to 1.4.14
Libgcrypt versions prior to 1.5.3
Description
The issue allows local users to obtain private RSA keys via a cache side-channel attack involving the L3 cache. This can lead to a violation of confidentiality of protected information. The exploitation of the issue can be carried out locally.
Recommendations
For libgcrypt versions 1.4.4 through 1.4.5, consider updating to a version prior to the vulnerability, such as libgcrypt version 1.5.3 or later.
For libgcrypt-devel versions 1.4.4 through 1.4.5, consider updating to a version prior to the vulnerability, such as libgcrypt version 1.5.3 or later.
For libgcrypt-debuginfo versions 1.4.4 through 1.4.5, consider updating to a version prior to the vulnerability, such as libgcrypt version 1.5.3 or later.
For GnuPG versions prior to 1.4.14, consider updating to GnuPG version 1.4.14 or later.
For Libgcrypt versions prior to 1.5.3, consider updating to Libgcrypt version 1.5.3 or later.
As a temporary workaround, consider restricting access to sensitive information until a patch is available.
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Centos
Gnupg
Red Hat
Suse
Libgcrypt