Side-Channel Attack Vulnerability in Libgcrypt Affects Multiple Platforms

CVE-2017-7526

What is CVE-2017-7526?

Libgcrypt versions earlier than 1.7.8 are subject to a critical vulnerability that enables a cache side-channel attack, which can potentially lead to the exposure of private RSA keys. This attack takes advantage of the left-to-right computation method used for sliding-window expansion, posing a significant security risk especially on systems where an attacker can execute arbitrary code. Although primarily affecting RSA-1024 keys, the same technique may also compromise RSA-2048 keys with increased effort. It is imperative for users of libgcrypt to update to version 1.7.8 or later to ensure protection against this vulnerability.

References