Daniel Moghimi

توجد ثغرة أمنية في ذاكرة DDR5 من SK Hynix، تسمح لمهاجم محلي بإحداث انعكاسات في البتات (bit flips) من نوع Rowhammer، مما يؤثر على سلامة الأجهزة وأمن النظام. يتجاوز الهجوم، المسمى «Phoenix» (CVE-2025-6202)، الحماية الحالية مثل رمز تصحيح الأخطاء (ECC) وتجديد الصف المستهدف (TRR). قد يؤدي الاستغلال الناجح إلى حدوث انعكاسات البتات في غضون 109 ثوانٍ، مما قد يعرض مفاتيح RSA للخطر، ويرفع الامتيازات إلى مستوى الجذر (root)، ويسمح بالوصول غير المصرح به إلى البيانات الحساسة. يتضمن الهجوم التلاعب بدورات تحديث ذاكرة DRAM لتحقيق انعكاسات بتات مستقرة، حتى مع وجود تدابير الحماية السارية. تؤثر هذه الثغرة الأمنية على أنظمة DDR5 القياسية على مستوى الإنتاج.

A sequence of processor instructions can lead to unexpected behavior in some Intel processors, potentially allowing an authenticated user to enable escalation of privilege, information disclosure, or denial of service via local access. This issue is related to the interpretation of redundant prefixes and can cause the system to crash or become unresponsive. The vulnerability, termed Reptar, primarily affects multi-tenant virtualized environments where multiple virtual machines are run on the same host.

The issue is related to information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors. This may allow an authenticated user to potentially enable information disclosure via local access. The vulnerability, known as Downfall, affects Intel consumer and server processors ranging from the Skylake family to Rocket Lake. It enables a user to access and steal data from other users who share the same computer. The vulnerability is caused by memory optimization features in Intel processors that unintentionally reveal internal data.

The issue is related to the `wc ecc mulmod ex` function, which does not properly resist side-channel attacks.

The issue is related to the mishandling of calls to the `wc SignatureGenerateHash` function, which can lead to fault injection in RSA cryptography.

An issue was discovered in a non-default configuration where DSA is enabled, allowing a side-channel attack against the nonce due to the use of the BEEA algorithm during modular inversion of the nonce in DSA signing.

The issue is related to a side-channel timing attack that allows attackers to extract the ECDSA private key due to mishandled ECDSA scalar multiplication. This vulnerability is associated with defects in the cryptographic algorithms used in the TPM processor's firmware. An attacker can exploit this issue to recover the value of closed keys stored in the Trusted Platform Module.

The issue is related to cryptographic timing conditions in the Intel(R) PTT, Intel(R) TXE, and Intel(R) SPS subsystems, which may allow an unauthenticated user to potentially enable information disclosure via network access. This vulnerability is associated with a lack of protection for service data and may allow a remote attacker to access cryptographic keys stored in the Trusted Platform Module (TPM).