Scientific Linux SL5/SL6: SLSA-2013:1457-1 Moderate: libgcrypt Cache Flaw

Date: Thu, 24 Oct 2013 16:49:46 +0000
Reply-To: scientific-linux-users@
Sender: Security Errata for Scientific Linux
 
From: Pat Riehecky 
Subject: Security ERRATA Moderate: libgcrypt on SL5.x, SL6.x i386/x86_64
MIME-Version: 1.0

Synopsis: Moderate: libgcrypt security update
Advisory ID: SLSA-2013:1457-1
Issue Date: 2013-10-24
CVE Numbers: CVE-2013-4242
--

It was found that GnuPG was vulnerable to the Yarom/Falkner flush+reload
cache side-channel attack on the RSA secret exponent. An attacker able to
execute a process on the logical CPU that shared the L3 cache with the
GnuPG process (such as a different local user or a user of a KVM guest
running on the same host with the kernel same-page merging functionality
enabled) could possibly use this flaw to obtain portions of the RSA secret
key. (CVE-2013-4242)
--

SL5
 x86_64
 libgcrypt-1.4.4-7.el5_10.i386.rpm
 libgcrypt-1.4.4-7.el5_10.x86_64.rpm
 libgcrypt-debuginfo-1.4.4-7.el5_10.i386.rpm
 libgcrypt-debuginfo-1.4.4-7.el5_10.x86_64.rpm
 libgcrypt-devel-1.4.4-7.el5_10.i386.rpm
 libgcrypt-devel-1.4.4-7.el5_10.x86_64.rpm
 i386
 libgcrypt-1.4.4-7.el5_10.i386.rpm
 libgcrypt-debuginfo-1.4.4-7.el5_10.i386.rpm
 libgcrypt-devel-1.4.4-7.el5_10.i386.rpm
SL6
 x86_64
 libgcrypt-1.4.5-11.el6_4.i686.rpm
 libgcrypt-1.4.5-11.el6_4.x86_64.rpm
 libgcrypt-debuginfo-1.4.5-11.el6_4.i686.rpm
 libgcrypt-debuginfo-1.4.5-11.el6_4.x86_64.rpm
 libgcrypt-devel-1.4.5-11.el6_4.i686.rpm
 libgcrypt-devel-1.4.5-11.el6_4.x86_64.rpm
 i386
 libgcrypt-1.4.5-11.el6_4.i686.rpm
 libgcrypt-debuginfo-1.4.5-11.el6_4.i686.rpm
 libgcrypt-devel-1.4.5-11.el6_4.i686.rpm

- Scientific Linux Development Team