Libgcrypt vulnerabilities

Libgcrypt before version 1.8.1 does not properly consider Curve25519 side-channel attacks, making it easier for attackers to discover a secret key.

Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.

A vulnerability in Libgcrypt before version 1.12.2 allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext passed to gcry_pk_decrypt.

A timing-based side-channel flaw was found in libgcrypt's RSA implementation. It may allow a remote attacker to perform a Bleichenbacher-style attack, leading to decryption of RSA ciphertexts.

Vulnerability in Libgcrypt before versions 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption due to missing exponent blinding, enabling a side-channel attack on mpi_powm. Additionally, the window size is not chosen appropriately, increasing information leakage risk.

In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.) NOTE: the vendor's position is that the issue report cannot be validated because there is no description of an attack

Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 is vulnerable to a memory-cache side-channel attack on ECDSA signatures, known as Return Of the Hidden Number Problem (ROHNP). The attack can be mitigated by using blinding during the signing process in the _gcry_ecc_ecdsa_sign function. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.