CVE-2019-12904 — Resource Exposure in Libgcrypt
Severity
5.9MEDIUMNVD
EPSS
0.3%
top 51.23%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJun 20
Latest updateMay 24
Description
In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.) NOTE: the vendor's position is that the issue report cannot be validated because there is no description of an attack
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 2.2 | Impact: 3.6
Affected Packages3 packages
Patches
🔴Vulnerability Details
3📋Vendor Advisories
1Red Hat▶
Libgcrypt: physical addresses being available to other processes leads to a flush-and-reload side-channel attack↗2019-07-16
💬Community
3Bugzilla▶
CVE-2019-12904 mingw-libgcrypt: Libgcrypt: physical addresses being available to other processes leads to a flush-and-reload side-channel attack [epel-7]↗2019-09-17
Bugzilla▶
CVE-2019-12904 libgcrypt: physical addresses being available to other processes leads to a flush-and-reload side-channel attack [fedora-all]↗2019-07-16
Bugzilla▶
CVE-2019-12904 Libgcrypt: physical addresses being available to other processes leads to a flush-and-reload side-channel attack↗2019-07-16