CVE-2019-12904

Name of the Vulnerable Software and Affected Versions Libgcrypt version 1.8.4

Description The C implementation of AES in Libgcrypt is susceptible to a flush-and-reload side-channel attack. This occurs because physical addresses are accessible to other processes, and the C implementation is used on platforms where an assembly-language implementation is not available. The vendor has stated that the issue report cannot be validated due to the lack of a described attack.

Recommendations For Libgcrypt version 1.8.4, consider updating to a newer version that addresses the side-channel attack issue, as the current version's C implementation of AES poses a security risk. At the moment, there is no information about a newer version that contains a fix for this vulnerability.