AES Vulnerability in Libgcrypt Affects Multiple Platforms

CVE-2019-12904

What is CVE-2019-12904?

In versions of Libgcrypt up to and including 1.8.4, a side-channel vulnerability exists in the C implementation of AES that can be exploited via flush-and-reload techniques. This susceptibility arises due to the exposure of physical addresses to other processes, which can potentially allow an attacker to recover cryptographic keys. While the vendor suggests the issue report lacks validation, the underlying risk underscores the importance of employing secure coding practices and implementing mitigations against such side-channel attacks.

References