Code:  void prefetch_table(const void *tab, size_t len)
 {
   const volatile byte *vtab = tab;
   size_t i;
 
  for (i = 0; i < len; i += 8 * 32)
     {
       (void)vtab[i + 0 * 32];
       (void)vtab[i + 1 * 32];
      (void)vtab[i + 2 * 32];
      (void)vtab[i + 3 * 32];
      (void)vtab[i + 4 * 32];
      (void)vtab[i + 5 * 32];
       (void)vtab[i + 6 * 32];
       (void)vtab[i + 7 * 32];
     }
 
   (void)vtab[len - 1];
 }

Vulnerability Type: 
CWE ID: CWE-310
Summary: In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.)
Commit Message: GCM: move look-up table to .data section and unshare between processes

* cipher/cipher-gcm.c (ATTR_ALIGNED_64): New.
(gcmR): Move to 'gcm_table' structure.
(gcm_table): New structure for look-up table with counters before and
after.
(gcmR): New macro.
(prefetch_table): Handle input with length not multiple of 256.
(do_prefetch_tables): Modify pre- and post-table counters to unshare
look-up table pages between processes.
--

GnuPG-bug-id: 4541
Signed-off-by: Jussi Kivilinna <jussi.kivilinna@iki.fi>