CVE-2015-0837
CVE-2015-0837
| Published Date | 2019-11-29 |
|---|---|
| Product | centos |
| Severity | Medium (5.9) |
| Component | libgcrypt |
| Affected Versions | CentOS 7 |
| Patched Versions | libgcrypt-1.5.3-14_ol003.el7 |
CVE Details
OL CVE Issue Summary
This is a local side-channel key-extraction weakness in libgcrypt's modular exponentiation mpi-pow.c:gcry_mpi_powm(), reachable through ElGamal (and RSA) decryption. In libgcrypt 1.5.3 the square-and-multiply loop performs the "always multiply" defence only when the exponent is stored in secure
memory (if (esec || (mpi_limb_signed_t)e < 0)); otherwise the multiply is skipped when the exponent bit is zero, so the number of multiply operations (hence the timing / cache pattern) depends on the secret exponent.