CVE-2013-4242
LOW severity · CVSS 1.9 · Information disclosure
1.9CVSS LOW
Summary
GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x and possibly other products, allows local users to obtain private RSA keys via a cache side-channel attack involving the L3 cache, aka Flush+Reload.
Impact & exploitability
Attack vectorLocal
Attack complexity—
Privileges required—
User interaction—
Confidentiality impact—
Integrity impactNone
Availability impactNone
Exploit probability (EPSS)1%
AV:L/AC:M/Au:N/C:P/I:N/A:N
Affected products we track (1)
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.
Additional information
- NVD record
- http://lists.opensuse.org/opensuse-updates/2013-08/msg00003.htmlAdvisory
- http://secunia.com/advisories/54318Advisory
- http://secunia.com/advisories/54321Advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=717880
- http://eprint.iacr.org/2013/448
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000330.html
- http://rhn.redhat.com/errata/RHSA-2013-1457.html