CVE-2015-7511

What it actually does

Improper elliptic-curve point multiplication in Libgcrypt during ECDH decryption enables extraction of private keys via electromagnetic side-channel analysis.

Why it matters to the business

Systems relying on vulnerable cryptographic libraries risk long-term key compromise when an attacker obtains brief physical proximity, though overall exposure remains low due to the required physical access vector.

How an attack unfolds

A physically proximate attacker positions electromagnetic measurement equipment near a device performing ECDH decryption with Libgcrypt, captures emanations during the flawed curve multiplication, and recovers the private key offline.

How to fix it

Upgrade Libgcrypt to version 1.6.5 or later on all affected systems; rebuild dependent packages such as GnuPG against the fixed library.

How to confirm the fix worked

Confirm installed Libgcrypt version is 1.6.5 or newer via package manager queries; perform regression tests exercising ECDH operations to verify side-channel resistance.

Typical attack path

1. Obtain physical proximity to the target hardware
2. Trigger or observe ECDH decryption operations
3. Capture and process electromagnetic emanations
4. Recover ECDH private keys from side-channel data

How to detect it

Examine physical security logs and hardware access records for unexplained proximity events; review application logs for ECDH key usage patterns around suspected exposure windows.

What your security team should do

• Prioritize patching Libgcrypt to 1.6.5+ across all distributions
• Review and strengthen physical access controls around cryptographic endpoints
• Inventory and replace any long-lived ECDH keys generated on vulnerable versions