PT-2018-2344 · Gnu+5 · Libgcrypt+5
Keegan Ryan
·
Published
2018-06-13
·
Updated
2024-06-15
·
CVE-2018-0495
CVSS v3.1
4.7
Medium
| Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Libgcrypt versions prior to 1.7.10
Libgcrypt versions 1.8.x prior to 1.8.3
Description
The issue is related to the
gcry ecc ecdsa sign function in the cipher/ecc-ecdsa.c file of the Libgcrypt cryptographic library. It allows an attacker to potentially guess the base parameters of a digital signature by iterating through cache values and evaluating the execution time of mathematical calculations. This could enable the attacker to recreate the private ECDSA and DSA keys used for creating the digital signature. Exploitation of this issue may allow an attacker with access to the local machine or a different virtual machine on the same physical host to gain unauthorized access to protected information.Recommendations
For Libgcrypt versions prior to 1.7.10, update to version 1.7.10 or later.
For Libgcrypt versions 1.8.x prior to 1.8.3, update to version 1.8.3 or later.
As a temporary workaround, consider using blinding during the signing process in the
gcry ecc ecdsa sign function to mitigate the issue.Exploit
Fix
Information Disclosure
Side Channel Attack
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Centos
Libgcrypt
Red Hat
Suse
Ubuntu