Daniel Moghimi

Existe uma vulnerabilidade na memória DDR5 da SK Hynix, permitindo que um atacante local acione inversões de bits (bit flips) do tipo Rowhammer, impactando a integridade do hardware e a segurança do sistema. O ataque, denominado "Phoenix" (CVE-2025-6202), contorna proteções existentes como Código de Correção de Erros (ECC) e Target Row Refresh (TRR). A exploração bem-sucedida pode levar a inversões de bits em até 109 segundos, potencialmente comprometendo chaves RSA, elevando privilégios para root e permitindo acesso não autorizado a dados sensíveis. O ataque envolve a manipulação dos ciclos de atualização da DRAM para alcançar inversões de bits estáveis, mesmo com medidas de proteção vigentes. A vulnerabilidade afeta sistemas DDR5 padrão de nível de produção.

A sequence of processor instructions can lead to unexpected behavior in some Intel processors, potentially allowing an authenticated user to enable escalation of privilege, information disclosure, or denial of service via local access. This issue is related to the interpretation of redundant prefixes and can cause the system to crash or become unresponsive. The vulnerability, termed Reptar, primarily affects multi-tenant virtualized environments where multiple virtual machines are run on the same host.

The issue is related to information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors. This may allow an authenticated user to potentially enable information disclosure via local access. The vulnerability, known as Downfall, affects Intel consumer and server processors ranging from the Skylake family to Rocket Lake. It enables a user to access and steal data from other users who share the same computer. The vulnerability is caused by memory optimization features in Intel processors that unintentionally reveal internal data.

The issue is related to the `wc ecc mulmod ex` function, which does not properly resist side-channel attacks.

The issue is related to the mishandling of calls to the `wc SignatureGenerateHash` function, which can lead to fault injection in RSA cryptography.

An issue was discovered in a non-default configuration where DSA is enabled, allowing a side-channel attack against the nonce due to the use of the BEEA algorithm during modular inversion of the nonce in DSA signing.

The issue is related to a side-channel timing attack that allows attackers to extract the ECDSA private key due to mishandled ECDSA scalar multiplication. This vulnerability is associated with defects in the cryptographic algorithms used in the TPM processor's firmware. An attacker can exploit this issue to recover the value of closed keys stored in the Trusted Platform Module.

The issue is related to cryptographic timing conditions in the Intel(R) PTT, Intel(R) TXE, and Intel(R) SPS subsystems, which may allow an unauthenticated user to potentially enable information disclosure via network access. This vulnerability is associated with a lack of protection for service data and may allow a remote attacker to access cryptographic keys stored in the Trusted Platform Module (TPM).