CVE-2021-33560
HighCVSS 7.5Exploitation Probability (EPSS)
High risk83th percentile - higher than 83% of all known CVEs
Summary
Vulnerability in Libgcrypt before versions 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption due to missing exponent blinding, enabling a side-channel attack on mpi_powm. Additionally, the window size is not chosen appropriately, increasing information leakage risk.
Risk Assessment
An attacker can exploit this vulnerability to recover the ElGamal private key through timing or other side-channel observations, compromising the confidentiality of encrypted data, e.g., in OpenPGP implementations.
Recommendation
Immediately upgrade Libgcrypt to version 1.8.8 or later (for 1.8.x branch) or 1.9.3 or later (for 1.9.x branch). After upgrading, regenerate all ElGamal keys.
Other vulnerabilities in Libgcrypt
See all- CVE-2017-0379High
Libgcrypt before version 1.8.1 does not properly consider Curve25519 side-channel attacks, making it easier for attackers to discover a secret key.
- CVE-2026-41990Medium
Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.
- CVE-2026-41989Medium
A vulnerability in Libgcrypt before version 1.12.2 allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext passed to gcry_pk_decrypt.
- CVE-2024-2236Medium
A timing-based side-channel flaw was found in libgcrypt's RSA implementation. It may allow a remote attacker to perform a Bleichenbacher-style attack, leading to decryption of RSA ciphertexts.
- CVE-2019-12904Medium
In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.) NOTE: the vendor's position is that the issue report cannot be validated because there is no description of an attack
- CVE-2018-0495Medium
Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 is vulnerable to a memory-cache side-channel attack on ECDSA signatures, known as Return Of the Hidden Number Problem (ROHNP). The attack can be mitigated by using blinding during the signing process in the _gcry_ecc_ecdsa_sign function. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.
Original NVD description (English source)
Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS