CVE-2019-12904
MediumCVSS 5.9Exploitation Probability (EPSS)
High risk82th percentile - higher than 82% of all known CVEs
Summary
In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.) NOTE: the vendor's position is that the issue report cannot be validated because there is no description of an attack
Risk Assessment
The vulnerability may allow a local attacker to recover AES keys by observing memory access patterns, potentially leading to breach of confidentiality of encrypted data.
Recommendation
Update Libgcrypt to a version newer than 1.8.4 if available, or use the assembly implementation of AES if possible to mitigate side-channel risks.
Other vulnerabilities in Libgcrypt
See all- CVE-2017-0379High
Libgcrypt before version 1.8.1 does not properly consider Curve25519 side-channel attacks, making it easier for attackers to discover a secret key.
- CVE-2026-41990Medium
Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.
- CVE-2026-41989Medium
A vulnerability in Libgcrypt before version 1.12.2 allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext passed to gcry_pk_decrypt.
- CVE-2024-2236Medium
A timing-based side-channel flaw was found in libgcrypt's RSA implementation. It may allow a remote attacker to perform a Bleichenbacher-style attack, leading to decryption of RSA ciphertexts.
- CVE-2021-33560High
Vulnerability in Libgcrypt before versions 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption due to missing exponent blinding, enabling a side-channel attack on mpi_powm. Additionally, the window size is not chosen appropriately, increasing information leakage risk.
- CVE-2018-0495Medium
Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 is vulnerable to a memory-cache side-channel attack on ECDSA signatures, known as Return Of the Hidden Number Problem (ROHNP). The attack can be mitigated by using blinding during the signing process in the _gcry_ecc_ecdsa_sign function. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.
Original NVD description (English source)
In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.) NOTE: the vendor's position is that the issue report cannot be validated because there is no description of an attack
Vulnerability data from NVD (NIST) · CISA KEV · EPSS