CVE-2019-12904 Information disclosure in n/a
A flush-and-reload side-channel vulnerability in Libgcrypt's C AES implementation could allow local attackers to recover cryptographic keys.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-12904?
CVE-2019-12904 is a medium-severity vulnerability in Opensuse Leap, published on 19 Jun 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.) NOTE: the vendor's position is that the issue report cannot be validated because there is no description of an attack
Weakness: CWE-668
Which versions are affected by CVE-2019-12904?
It affects 2 products.
Linux distribution packages (3)
libgcrypt SUSE:Linux Enterprise Module for Basesystem 15 | All versions | 1.8.2-6.17.1 |
libgcrypt SUSE:Linux Enterprise Module for Basesystem 15 SP1 | All versions | 1.8.2-8.6.2 |
libgcrypt openSUSE:Leap 15.0 | All versions | 1.8.2-lp150.5.10.1 |
Products include Gnupg Libgcrypt, Opensuse Leap.
How do I fix CVE-2019-12904?
Apply the vendor's patch.
Is CVE-2019-12904 being exploited?
There is no known exploitation of CVE-2019-12904 in the wild and no public exploit code.
Other vulnerabilities in Opensuse Leap
Sources
Also known as ALPINE-CVE-2019-12904, GHSA-w862-39x5-q88x, SUSE-SU-2019:1859-1, SUSE-SU-2019:1971-1, openSUSE-SU-2019:1792-1.