<html><head></head><body><div>All parts of the cryptographic code can change the process through prctl(), in order to avoid the information disclosure vulnerabilities.</div><div><br></div><div>The best way to achieve protection is obviously by calling prctl() during the cryptographic application startup and this is precisely what the gnupg patch does:</div><div><br></div><div><a href="https://lists.gnupg.org/pipermail/gnupg-devel/2025-May/035904.html">https://lists.gnupg.org/pipermail/gnupg-devel/2025-May/035904.html</a></div><div><br></div><div>However it is not possible to foresee all the other applications using libgcrypt, so another preventive patch has been submitted so that prctl() is also called by the cryptographic library and this is what the libgcrypt patch does:</div><div><div><br></div><div><a href="https://lists.gnupg.org/pipermail/gcrypt-devel/2025-May/005856.html" style="cursor: text;">https://lists.gnupg.org/pipermail/gcrypt-devel/2025-May/005856.html</a></div></div><div><br></div><div>By applying the companion libgcrypt patch we offer some kind of protection to applications other than gnupg, even though the level of protection is not the same as if prctl() was called at application startup.</div><div><br></div><div>Please note that calling prctl() twice in gnupg and then in libgcrypt has no side-effects.</div><div><br></div><div>The fact that other cryptographic libraries such as openssl do not do the same only means that they are vulnerable those cryptographic information disclosure vulnerabilities.</div><div><br></div><div>Regards,</div><div><br></div><div>Guido</div><div><br></div><div>On Mon, 23/06/2025 at 19.58 +0200, Werner Koch wrote:</div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div>On Mon, 23 Jun 2025 13:57, Guido Trentalancia said:</div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div>It does not change the property of the system, it only changes the</div></blockquote><div><br></div><div>Sorry, with "system" I meant the process with its main application and</div><div>all other libraries. Libgcrypt is a library usally linked at runtime</div><div>and thus it would be surprising if it changes such process properties.</div><div><br></div><div><br></div><div>Salam-Shalom,</div><div><br></div><div> Werner</div><div><br></div></blockquote></body></html>