NVD Vulnerability Detail

CVE-2013-4242

Summary	GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x and possibly other products, allows local users to obtain private RSA keys via a cache side-channel attack involving the L3 cache, aka Flush+Reload.
Publication Date	Aug. 20, 2013, 8:55 a.m.
Registration Date	Jan. 26, 2021, 3:42 p.m.
Last Update	Nov. 21, 2024, 10:55 a.m.

CVSS2.0 : LOW
Score	1.9
Vector	AV:L/AC:M/Au:N/C:P/I:N/A:N
攻撃元区分(AV)	ローカル
攻撃条件の複雑さ(AC)	中
攻撃前の認証要否(Au)	不要
機密性への影響(C)	低
完全性への影響(I)	なし
可用性への影響(A)	なし
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:o:canonical:ubuntu_linux:13.04:::::::*
cpe:2.3:o:canonical:ubuntu_linux:12.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:::::*
cpe:2.3:o:canonical:ubuntu_linux:10.04:-:lts:::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:7.0:::::::*
cpe:2.3:o:debian:debian_linux:6.0:::::::*

Configuration3	or higher	or less	more than	less than
cpe:2.3:a:gnupg:gnupg:0.9.9:::::::*
cpe:2.3:a:gnupg:gnupg:0.4.0:::::::*
cpe:2.3:a:gnupg:gnupg:0.9.0:::::::*
cpe:2.3:a:gnupg:gnupg:1.2.3:::::::*
cpe:2.3:a:gnupg:gnupg:0.9.10:::::::*
cpe:2.3:a:gnupg:gnupg::::::::		1.4.13
cpe:2.3:a:gnupg:gnupg:1.3.3:::::::*
cpe:2.3:a:gnupg:gnupg:1.0.1:::::::*
cpe:2.3:a:gnupg:gnupg:1.3.1:::::::*
cpe:2.3:a:gnupg:gnupg:0.2.19:::::::*
cpe:2.3:a:gnupg:gnupg:1.2.6:::::::*
cpe:2.3:a:gnupg:gnupg:0.3.5:::::::*
cpe:2.3:a:gnupg:gnupg:0.4.1:::::::*
cpe:2.3:a:gnupg:gnupg:0.9.1:::::::*
cpe:2.3:a:gnupg:gnupg:1.3.93:::::::*
cpe:2.3:a:gnupg:gnupg:0.3.0:::::::*
cpe:2.3:a:gnupg:gnupg:0.9.6:::::::*
cpe:2.3:a:gnupg:gnupg:0.4.3:::::::*
cpe:2.3:a:gnupg:gnupg:1.3.2:::::::*
cpe:2.3:a:gnupg:gnupg:1.4.10:::::::*
cpe:2.3:a:gnupg:gnupg:0.2.16:::::::*
cpe:2.3:a:gnupg:gnupg:1.4.0:::::::*
cpe:2.3:a:gnupg:gnupg:1.2.2:::::::*
cpe:2.3:a:gnupg:gnupg:1.3.4:::::::*
cpe:2.3:a:gnupg:gnupg:0.9.4:::::::*
cpe:2.3:a:gnupg:gnupg:0.9.8:::::::*
cpe:2.3:a:gnupg:gnupg:0.9.11:::::::*
cpe:2.3:a:gnupg:gnupg:0.0.0:-::::::
cpe:2.3:a:gnupg:gnupg:0.3.4:::::::*
cpe:2.3:a:gnupg:gnupg:0.2.18:::::::*
cpe:2.3:a:gnupg:gnupg:1.0.0:::::::*
cpe:2.3:a:gnupg:gnupg:0.9.3:::::::*
cpe:2.3:a:gnupg:gnupg:1.4.12:::::::*
cpe:2.3:a:gnupg:gnupg:0.3.2:::::::*
cpe:2.3:a:gnupg:gnupg:1.3.92:::::::*
cpe:2.3:a:gnupg:gnupg:1.0.7:::::::*
cpe:2.3:a:gnupg:gnupg:0.2.17:::::::*
cpe:2.3:a:gnupg:gnupg:1.2.5:::::::*
cpe:2.3:a:gnupg:gnupg:1.0.2:::::::*
cpe:2.3:a:gnupg:gnupg:1.0.4:::::::*
cpe:2.3:a:gnupg:gnupg:1.3.91:::::::*
cpe:2.3:a:gnupg:gnupg:1.2.1:windows::::::
cpe:2.3:a:gnupg:gnupg:1.0.5:-:win32:::::*
cpe:2.3:a:gnupg:gnupg:1.0.4:-:win32:::::*
cpe:2.3:a:gnupg:gnupg:0.9.7:::::::*
cpe:2.3:a:gnupg:gnupg:1.2.0:::::::*
cpe:2.3:a:gnupg:gnupg:1.0.6:::::::*
cpe:2.3:a:gnupg:gnupg:1.0.3:::::::*
cpe:2.3:a:gnupg:gnupg:1.2.7:::::::*
cpe:2.3:a:gnupg:gnupg:1.4.11:::::::*
cpe:2.3:a:gnupg:gnupg:0.3.1:::::::*
cpe:2.3:a:gnupg:gnupg:1.2.1:::::::*
cpe:2.3:a:gnupg:gnupg:0.3.3:::::::*
cpe:2.3:a:gnupg:gnupg:1.2.4:::::::*
cpe:2.3:a:gnupg:gnupg:0.9.5:::::::*
cpe:2.3:a:gnupg:gnupg:1.0.5:::::::*
cpe:2.3:a:gnupg:gnupg:0.2.15:::::::*
cpe:2.3:a:gnupg:gnupg:0.4.4:::::::*
cpe:2.3:a:gnupg:gnupg:0.9.2:::::::*
cpe:2.3:a:gnupg:gnupg:1.3.90:::::::*
cpe:2.3:a:gnupg:gnupg:1.3.0:::::::*
cpe:2.3:a:gnupg:gnupg:1.3.6:::::::*
cpe:2.3:a:gnupg:gnupg:0.4.5:::::::*

Configuration4	or higher	or less	more than	less than
cpe:2.3:a:gnupg:gnupg:2.0.1:::::::*
cpe:2.3:a:gnupg:gnupg:2.0.7:::::::*
cpe:2.3:a:gnupg:gnupg:2.0.15:::::::*
cpe:2.3:a:gnupg:gnupg:2.0.8:::::::*
cpe:2.3:a:gnupg:gnupg:2.0.11:::::::*
cpe:2.3:a:gnupg:gnupg:2.0.6:::::::*
cpe:2.3:a:gnupg:gnupg:2.0.10:::::::*
cpe:2.3:a:gnupg:gnupg:2.0.13:::::::*
cpe:2.3:a:gnupg:gnupg:2.0.5:::::::*
cpe:2.3:a:gnupg:gnupg:2.0.17:::::::*
cpe:2.3:a:gnupg:gnupg:2.0.12:::::::*
cpe:2.3:a:gnupg:gnupg:2.0.18:::::::*
cpe:2.3:a:gnupg:gnupg:2.0.16:::::::*
cpe:2.3:a:gnupg:gnupg:2.0.14:::::::*
cpe:2.3:a:gnupg:gnupg:2.0.4:::::::*
cpe:2.3:a:gnupg:gnupg:2.0.3:::::::*
cpe:2.3:a:gnupg:gnupg:2.0.19:::::::*

Configuration5	or higher	or less	more than	less than
cpe:2.3:a:gnupg:libgcrypt:1.4.6:::::::*
cpe:2.3:a:gnupg:libgcrypt:1.4.4:::::::*
cpe:2.3:a:gnupg:libgcrypt:1.5.0:::::::*
cpe:2.3:a:gnupg:libgcrypt::::::::		1.5.2
cpe:2.3:a:gnupg:libgcrypt:1.5.1:::::::*
cpe:2.3:a:gnupg:libgcrypt:1.4.0:::::::*
cpe:2.3:a:gnupg:libgcrypt:1.4.3:::::::*
cpe:2.3:a:gnupg:libgcrypt:1.4.5:::::::*

Configuration6	or higher	or less	more than	less than
cpe:2.3:o:opensuse:opensuse:12.3:::::::*
cpe:2.3:o:opensuse:opensuse:12.2:::::::*

Related information, measures and tools

No	URL	タグ
1	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=717880
2	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=717880
3	http://eprint.iacr.org/2013/448
4	http://eprint.iacr.org/2013/448
5	http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
6	http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
7	http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000330.html
8	http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000330.html
9	http://lists.opensuse.org/opensuse-updates/2013-08/msg00003.html	Vendor Advisory
10	http://lists.opensuse.org/opensuse-updates/2013-08/msg00003.html	Vendor Advisory
11	http://rhn.redhat.com/errata/RHSA-2013-1457.html
12	http://rhn.redhat.com/errata/RHSA-2013-1457.html
13	http://secunia.com/advisories/54318	Vendor Advisory
14	http://secunia.com/advisories/54318	Vendor Advisory
15	http://secunia.com/advisories/54321	Vendor Advisory
16	http://secunia.com/advisories/54321	Vendor Advisory
17	http://secunia.com/advisories/54332	Vendor Advisory
18	http://secunia.com/advisories/54332	Vendor Advisory
19	http://secunia.com/advisories/54375	Vendor Advisory
20	http://secunia.com/advisories/54375	Vendor Advisory
21	http://www.debian.org/security/2013/dsa-2730
22	http://www.debian.org/security/2013/dsa-2730
23	http://www.debian.org/security/2013/dsa-2731
24	http://www.debian.org/security/2013/dsa-2731
25	http://www.kb.cert.org/vuls/id/976534	US Government Resource
26	http://www.kb.cert.org/vuls/id/976534	US Government Resource
27	http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
28	http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
29	http://www.securityfocus.com/bid/61464
30	http://www.securityfocus.com/bid/61464
31	http://www.ubuntu.com/usn/USN-1923-1	Vendor Advisory
32	http://www.ubuntu.com/usn/USN-1923-1	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-200	情報漏えい	https://cwe.mitre.org/data/definitions/200.html

JVN Vulnerability Information

マルチコア CPU の共有 L3 キャッシュに対するサイドチャネル攻撃

Title	マルチコア CPU の共有 L3 キャッシュに対するサイドチャネル攻撃
Summary	マルチコア CPU の共有 L3 キャッシュに対するサイドチャネル攻撃手法が公開されています。詳しくは、以下のページをご確認ください。 Flush+Reload: a High Resolution, Low Noise, L3 Cache Side-Channel Attack http://eprint.iacr.org/2013/448.pdf この問題は情報漏えい (CWE-200) の脆弱性の一種です。
Possible impacts	共有 L3 キャッシュを通じて、他のプロセスからメモリ内容を推測される可能性があります。結果として、機密情報などを取得される可能性があります。 Flush+Reload: a High Resolution, Low Noise, L3 Cache Side-Channel Attack では、Intel Ivy Bridge プラットフォーム上で本攻撃手法を適用することで、GnuPG の RSA 秘密鍵を 98% まで復元できることが示されています。
Solution	[アップデートする] 各開発者が提供する情報や、VU#976534 の Vendor Information をもとに、該当する製品をアップデートしてください。 GnuPG は本脆弱性の対策版として GnuPG 1.4.14 と Libgcrypt 1.5.3 を公開しています。 [ワークアラウンドを実施する] ハイパーバイザ型の仮想環境では、以下の回避策を適用することで、本脆弱性の影響を軽減することが可能です。　* memory page de-duplication 機能を無効にする
Publication Date	July 29, 2013, midnight
Registration Date	Aug. 21, 2013, 8:09 p.m.
Last Update	May 23, 2014, 2:52 p.m.

Affected System

オラクル

Oracle Solaris 10

Oracle Solaris 11.1

GNU Project

GnuPG 1.4.14 未満

GnuPG 2.0.x

Libgcrypt 1.5.3 未満

Debian

Debian GNU/Linux 6.0

Debian GNU/Linux 7.0

Novell

openSUSE 12.2

openSUSE 12.3

Canonical

Ubuntu 10.04 LTS

Ubuntu 12.04 LTS

Ubuntu 12.10

Ubuntu 13.04

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2013-4242	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4242
National Vulnerability Database (NVD)
2	CVE-2013-4242	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4242
SECURITY BLOG
3	CVE-2013-4242 Information Disclosure vulnerability in libgcrypt	https://blogs.oracle.com/sunsecurity/entry/cve_2013_4242_information_disclosure

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-200	https://jvndb.jvn.jp/ja/cwe/CWE-200.html

ベンダー情報

No	Name	URL
Debian Bug report logs
1	717880	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=717880
Debian Security Advisory
2	DSA-2730	http://www.debian.org/security/2013/dsa-2730
3	DSA-2731	http://www.debian.org/security/2013/dsa-2731
GnuPG Project
4	Download	http://www.gnupg.org/download/
opensuse-updates
5	openSUSE-SU-2013:1294	http://lists.opensuse.org/opensuse-updates/2013-08/msg00003.html
Red Hat Security Advisory
6	RHSA-2013:1457	http://rhn.redhat.com/errata/RHSA-2013-1457.html
Ubuntu Security Notice
7	USN-1923-1	http://www.ubuntu.com/usn/USN-1923-1

その他

No	Name	URL
JVN
1	JVNVU#94473961	http://jvn.jp/cert/JVNVU94473961/index.html
US-CERT Vulnerability Note
2	VU#976534	http://www.kb.cert.org/vuls/id/976534
関連文書
3	Flush+Reload: a High Resolution, Low Noise, L3 Cache Side-Channel Attack	http://eprint.iacr.org/2013/448.pdf

Change Log

No	Changed Details	Date of change
0	[2013年08月21日] 掲載 [2013年10月04日] タイトル：内容を更新概要：内容を更新影響を受けるシステム：内容を更新想定される影響：内容を更新対策：内容を更新参考情報：JVN (JVNVU#94473961) を追加参考情報：US-CERT Vulnerability Note (VU#976534) を追加参考情報：関連文書 (Flush+Reload: a High Resolution, Low Noise, L3 Cache Side-Channel Attack) を追加 [2013年10月23日] CVSS による深刻度：内容を更新 [2013年10月28日] 影響を受けるシステム：内容を更新 [2013年11月11日] ベンダ情報：レッドハット (RHSA-2013:1457) を追加 [2014年05月14日] ベンダ情報：オラクル (CVE-2013-4242 Information Disclosure vulnerability in libgcrypt) を追加 [2014年05月23日] 影響を受けるシステム：内容を更新	Feb. 17, 2018, 10:37 a.m.

Configuration3	or higher	or less	more than	less than
cpe:2.3:a:gnupg:gnupg:0.9.9:::::::*
cpe:2.3:a:gnupg:gnupg:0.4.0:::::::*
cpe:2.3:a:gnupg:gnupg:0.9.0:::::::*
cpe:2.3:a:gnupg:gnupg:1.2.3:::::::*
cpe:2.3:a:gnupg:gnupg:0.9.10:::::::*
cpe:2.3:a:gnupg:gnupg::::::::		1.4.13
cpe:2.3:a:gnupg:gnupg:1.3.3:::::::*
cpe:2.3:a:gnupg:gnupg:1.0.1:::::::*
cpe:2.3:a:gnupg:gnupg:1.3.1:::::::*
cpe:2.3:a:gnupg:gnupg:0.2.19:::::::*
cpe:2.3:a:gnupg:gnupg:1.2.6:::::::*
cpe:2.3:a:gnupg:gnupg:0.3.5:::::::*
cpe:2.3:a:gnupg:gnupg:0.4.1:::::::*
cpe:2.3:a:gnupg:gnupg:0.9.1:::::::*
cpe:2.3:a:gnupg:gnupg:1.3.93:::::::*
cpe:2.3:a:gnupg:gnupg:0.3.0:::::::*
cpe:2.3:a:gnupg:gnupg:0.9.6:::::::*
cpe:2.3:a:gnupg:gnupg:0.4.3:::::::*
cpe:2.3:a:gnupg:gnupg:1.3.2:::::::*
cpe:2.3:a:gnupg:gnupg:1.4.10:::::::*
cpe:2.3:a:gnupg:gnupg:0.2.16:::::::*
cpe:2.3:a:gnupg:gnupg:1.4.0:::::::*
cpe:2.3:a:gnupg:gnupg:1.2.2:::::::*
cpe:2.3:a:gnupg:gnupg:1.3.4:::::::*
cpe:2.3:a:gnupg:gnupg:0.9.4:::::::*
cpe:2.3:a:gnupg:gnupg:0.9.8:::::::*
cpe:2.3:a:gnupg:gnupg:0.9.11:::::::*
cpe:2.3:a:gnupg:gnupg:0.0.0:-::::::
cpe:2.3:a:gnupg:gnupg:0.3.4:::::::*
cpe:2.3:a:gnupg:gnupg:0.2.18:::::::*
cpe:2.3:a:gnupg:gnupg:1.0.0:::::::*
cpe:2.3:a:gnupg:gnupg:0.9.3:::::::*
cpe:2.3:a:gnupg:gnupg:1.4.12:::::::*
cpe:2.3:a:gnupg:gnupg:0.3.2:::::::*
cpe:2.3:a:gnupg:gnupg:1.3.92:::::::*
cpe:2.3:a:gnupg:gnupg:1.0.7:::::::*
cpe:2.3:a:gnupg:gnupg:0.2.17:::::::*
cpe:2.3:a:gnupg:gnupg:1.2.5:::::::*
cpe:2.3:a:gnupg:gnupg:1.0.2:::::::*
cpe:2.3:a:gnupg:gnupg:1.0.4:::::::*
cpe:2.3:a:gnupg:gnupg:1.3.91:::::::*
cpe:2.3:a:gnupg:gnupg:1.2.1:windows::::::
cpe:2.3:a:gnupg:gnupg:1.0.5:-:win32:::::*
cpe:2.3:a:gnupg:gnupg:1.0.4:-:win32:::::*
cpe:2.3:a:gnupg:gnupg:0.9.7:::::::*
cpe:2.3:a:gnupg:gnupg:1.2.0:::::::*
cpe:2.3:a:gnupg:gnupg:1.0.6:::::::*
cpe:2.3:a:gnupg:gnupg:1.0.3:::::::*
cpe:2.3:a:gnupg:gnupg:1.2.7:::::::*
cpe:2.3:a:gnupg:gnupg:1.4.11:::::::*
cpe:2.3:a:gnupg:gnupg:0.3.1:::::::*
cpe:2.3:a:gnupg:gnupg:1.2.1:::::::*
cpe:2.3:a:gnupg:gnupg:0.3.3:::::::*
cpe:2.3:a:gnupg:gnupg:1.2.4:::::::*
cpe:2.3:a:gnupg:gnupg:0.9.5:::::::*
cpe:2.3:a:gnupg:gnupg:1.0.5:::::::*
cpe:2.3:a:gnupg:gnupg:0.2.15:::::::*
cpe:2.3:a:gnupg:gnupg:0.4.4:::::::*
cpe:2.3:a:gnupg:gnupg:0.9.2:::::::*
cpe:2.3:a:gnupg:gnupg:1.3.90:::::::*
cpe:2.3:a:gnupg:gnupg:1.3.0:::::::*
cpe:2.3:a:gnupg:gnupg:1.3.6:::::::*
cpe:2.3:a:gnupg:gnupg:0.4.5:::::::*

Configuration4	or higher	or less	more than	less than
cpe:2.3:a:gnupg:gnupg:2.0.1:::::::*
cpe:2.3:a:gnupg:gnupg:2.0.7:::::::*
cpe:2.3:a:gnupg:gnupg:2.0.15:::::::*
cpe:2.3:a:gnupg:gnupg:2.0.8:::::::*
cpe:2.3:a:gnupg:gnupg:2.0.11:::::::*
cpe:2.3:a:gnupg:gnupg:2.0.6:::::::*
cpe:2.3:a:gnupg:gnupg:2.0.10:::::::*
cpe:2.3:a:gnupg:gnupg:2.0.13:::::::*
cpe:2.3:a:gnupg:gnupg:2.0.5:::::::*
cpe:2.3:a:gnupg:gnupg:2.0.17:::::::*
cpe:2.3:a:gnupg:gnupg:2.0.12:::::::*
cpe:2.3:a:gnupg:gnupg:2.0.18:::::::*
cpe:2.3:a:gnupg:gnupg:2.0.16:::::::*
cpe:2.3:a:gnupg:gnupg:2.0.14:::::::*
cpe:2.3:a:gnupg:gnupg:2.0.4:::::::*
cpe:2.3:a:gnupg:gnupg:2.0.3:::::::*
cpe:2.3:a:gnupg:gnupg:2.0.19:::::::*

Configuration5	or higher	or less	more than	less than
cpe:2.3:a:gnupg:libgcrypt:1.4.6:::::::*
cpe:2.3:a:gnupg:libgcrypt:1.4.4:::::::*
cpe:2.3:a:gnupg:libgcrypt:1.5.0:::::::*
cpe:2.3:a:gnupg:libgcrypt::::::::		1.5.2
cpe:2.3:a:gnupg:libgcrypt:1.5.1:::::::*
cpe:2.3:a:gnupg:libgcrypt:1.4.0:::::::*
cpe:2.3:a:gnupg:libgcrypt:1.4.3:::::::*
cpe:2.3:a:gnupg:libgcrypt:1.4.5:::::::*