PT-2019-13013 · Gnu+2 · Libgcrypt+2

Published 2019-06-19 · Updated 2024-08-05 · CVE-2019-12904

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Libgcrypt version 1.8.4

Description The C implementation of AES in Libgcrypt is susceptible to a flush-and-reload side-channel attack. This occurs because physical addresses are accessible to other processes, and the C implementation is used on platforms where an assembly-language implementation is not available. The vendor has stated that the issue report cannot be validated due to the lack of a described attack.

Recommendations For Libgcrypt version 1.8.4, consider updating to a newer version that addresses the side-channel attack issue, as the current version's C implementation of AES poses a security risk. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

ALT-PU-2019-2588

ALT-PU-2020-1687

CVE-2019-12904

OPENSUSE-SU-2019:1792-1

OPENSUSE-SU-2019_1792-1

OPENSUSE-SU-2024:10941-1

SUSE-SU-2019:1859-1

SUSE-SU-2019:1971-1

SUSE-SU-2019_1859-1

SUSE-SU-2019_1971-1

Affected Products

Alt Linux

Libgcrypt

Suse

References · 28

• https://github.com/gpg/libgcrypt/commit/a4c561aab1014c3630bc88faf6f5246fee16b020 · Patch
• https://github.com/gpg/libgcrypt/commit/daedbbb5541cd8ecda1459d3b843ea4d92788762 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2019:1792-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00049.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12904 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12904 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10941-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:1859-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2019-12904 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:1971-1 · Vendor Advisory
• https://suse.com/security/cve/CVE-2021-33560 · Note
• https://bugzilla.suse.com/1097073 · Note
• https://dev.gnupg.org/T4541 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/UGEWFAF5J7VQL4GHXAYUK44DD2MT4ZUY/#UGEWFAF5J7VQL4GHXAYUK44DD2MT4ZUY · Note
• https://suse.com/security/cve/CVE-2018-0495 · Note