CVE-2024-2236
MediumCVSS 5.9Exploitation Probability (EPSS)
Elevated risk66th percentile - higher than 66% of all known CVEs
Summary
A timing-based side-channel flaw was found in libgcrypt's RSA implementation. It may allow a remote attacker to perform a Bleichenbacher-style attack, leading to decryption of RSA ciphertexts.
Risk Assessment
An attacker could decrypt confidential data protected by RSA, potentially compromising communication confidentiality.
Recommendation
Update libgcrypt to a patched version or apply vendor-recommended mitigations.
Other vulnerabilities in libgcrypt
See all- CVE-2017-0379High
Libgcrypt before version 1.8.1 does not properly consider Curve25519 side-channel attacks, making it easier for attackers to discover a secret key.
- CVE-2026-41990Medium
Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.
- CVE-2026-41989Medium
A vulnerability in Libgcrypt before version 1.12.2 allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext passed to gcry_pk_decrypt.
- CVE-2021-33560High
Vulnerability in Libgcrypt before versions 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption due to missing exponent blinding, enabling a side-channel attack on mpi_powm. Additionally, the window size is not chosen appropriately, increasing information leakage risk.
- CVE-2019-12904Medium
In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.) NOTE: the vendor's position is that the issue report cannot be validated because there is no description of an attack
- CVE-2018-0495Medium
Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 is vulnerable to a memory-cache side-channel attack on ECDSA signatures, known as Return Of the Hidden Number Problem (ROHNP). The attack can be mitigated by using blinding during the signing process in the _gcry_ecc_ecdsa_sign function. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.
Original NVD description (English source)
A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS