While working on PowerPC support (D490 D491 D492) I noticed that the C implementation of AES is vulnerable to side-channel attacks because it uses pre-computed S-box values, rather than computing them on the fly.
My patches are not vulnerable to this, but users of libgcrypt on PowerPC *before* my patches are.