Daniel Genkin

**Name of the Vulnerable Software and Affected Versions** Safari versions prior to 16.6 watchOS versions prior to 9.6 iOS versions prior to 15.7.8 and prior to 16.6 iPadOS versions prior to 15.7.8 and prior to 16.6 tvOS versions prior to 16.6 macOS Ventura versions prior to 13.5 **Description** A logic issue was addressed with improved state management, which may allow a website to track sensitive user information. This issue is related to the WebKitGTK and WPE WebKit modules, and its exploitation can lead to the disclosure of protected information. **Recommendations** For Safari versions prior to 16.6, update to Safari 16.6 or later. For watchOS versions prior to 9.6, update to watchOS 9.6 or later. For iOS versions prior to 15.7.8, update to iOS 15.7.8 or later. For iOS versions prior to 16.6, update to iOS 16.6 or later. For iPadOS versions prior to 15.7.8, update to iPadOS 15.7.8 or later. For iPadOS versions prior to 16.6, update to iPadOS 16.6 or later. For tvOS versions prior to 16.6, update to tvOS 16.6 or later. For macOS Ventura versions prior to 13.5, update to macOS Ventura 13.5 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 94.0.4606.54 **Description** The issue is related to side-channel information leakage in DevTools, allowing a remote attacker to bypass site isolation via a crafted HTML page. This is due to errors in data encryption. The attacker can exploit this issue to bypass existing security restrictions. **Recommendations** For versions prior to 94.0.4606.54, update to version 94.0.4606.54 or later to resolve the issue. As a temporary workaround, consider restricting access to DevTools or avoiding the use of crafted HTML pages that could exploit this issue.

**Name of the Vulnerable Software and Affected Versions** Intel microprocessors (affected versions not specified) **Description** The issue is related to a logic condition in specific microprocessors that may allow an authenticated user to potentially enable partial physical address information disclosure via local access. It is also associated with a lack of protection for service data. A side-channel attack, similar to DRAM Rowhammer attacks, can be used to steal sensitive data from device memory without directly accessing it. This type of attack allows attackers to read bits from adjacent rows, and it has been demonstrated against OpenSSH, resulting in the extraction of an RSA-2048 key from memory. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Intel SGX (affected versions not specified) Huawei VRP (affected versions not specified) **Description** The issue is related to the implementation of Intel Software Guard Extensions (SGX) technology and speculative execution in microprocessors. It may allow unauthorized disclosure of information from an enclave to an attacker with local user access via a side-channel analysis. This can enable an attacker to read data from the L1 cache, which may contain fragments of data from the protected area after speculative execution. **Recommendations** For Intel SGX, consider disabling speculative execution as a temporary workaround until a patch is available. For Huawei VRP, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Libgcrypt versions prior to 1.8.1 **Description** The issue makes it easier for attackers to discover a secret key due to not properly considering Curve25519 side-channel attacks, related to files cipher/ecc.c and mpi/ec.c. **Recommendations** For versions prior to 1.8.1, update to version 1.8.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** libgcrypt versions prior to 1.7.8 **Description** The issue is related to a cache side-channel attack that can lead to a complete break of RSA-1024 and potentially RSA-2048 with increased computation. This attack requires the ability to run arbitrary software on the hardware where the private RSA key is used, allowing a local attacker to compromise data confidentiality by fully recovering the RSA key using the left-to-right method for computing the sliding-window expansion. **Recommendations** For libgcrypt versions prior to 1.7.8, update to version 1.7.8 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** OpenSSL versions 1.0.1 through 1.0.1s OpenSSL versions 1.0.2 through 1.0.2g **Description** The issue is related to the MOD EXP CTIME COPY FROM PREBUF function in OpenSSL, which does not properly consider cache-bank access times during modular exponentiation. This makes it easier for local users to discover RSA keys by running a crafted application on the same Intel Sandy Bridge CPU core as a victim and leveraging cache-bank conflicts, also known as a "CacheBleed" attack. The vulnerability allows attackers to recover RSA keys via a side-channel attack. **Recommendations** For OpenSSL versions 1.0.1 through 1.0.1s, update to version 1.0.1s or later. For OpenSSL versions 1.0.2 through 1.0.2g, update to version 1.0.2g or later. As a temporary workaround, consider restricting access to the MOD EXP CTIME COPY FROM PREBUF function until a patch is available. Avoid using the `MOD EXP CTIME COPY FROM PREBUF` function in the affected OpenSSL versions until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Libgcrypt versions prior to 1.6.5 **Description** The issue makes it easier for physically proximate attackers to extract ECDH keys by measuring electromagnetic emanations due to improper elliptic-point curve multiplication during decryption. **Recommendations** For versions prior to 1.6.5, update to version 1.6.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Mbed TLS versions prior to 2.14.1 Mbed TLS versions prior to 2.7.8 Mbed TLS versions prior to 2.1.17 **Description** The issue is related to a local synchronization problem during RSA decryption in Mbed TLS, allowing a local unprivileged attacker to recover the plaintext of RSA decryption. This affects RSA-without-(EC)DH(E) cipher suites. The vulnerability can be exploited to gain access to protected information. **Recommendations** For versions prior to 2.14.1, update to version 2.14.1 or later. For versions prior to 2.7.8, update to version 2.7.8 or later. For versions prior to 2.1.17, update to version 2.1.17 or later.

**Name of the Vulnerable Software and Affected Versions** Libgcrypt versions prior to 1.6.3 GnuPG versions prior to 1.4.19 **Description** The issue concerns the lack of ciphertext blinding for Elgamal decryption, allowing physically proximate attackers to obtain the server's private key. This is achieved by determining factors using crafted ciphertext and analyzing the fluctuations in the electromagnetic field during multiplication. **Recommendations** For Libgcrypt versions prior to 1.6.3, update to version 1.6.3 or later to resolve the issue. For GnuPG versions prior to 1.4.19, update to version 1.4.19 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** libgcrypt versions prior to 1.5.4 **Description** The issue concerns the improper performance of ciphertext normalization and ciphertext randomization in libgcrypt, which can be exploited by physically proximate attackers to conduct key-extraction attacks. This is achieved by collecting voltage data from exposed metal, representing a different attack vector. The vulnerability can lead to a breach of confidentiality of protected information and can be exploited locally. **Recommendations** For libgcrypt versions prior to 1.5.4, update to version 1.5.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** GnuPG versions 1.4.5 through 1.4.15 **Description** The issue allows attackers to extract RSA keys via a chosen-ciphertext attack and acoustic cryptanalysis during decryption. This can be exploited remotely and may lead to a violation of the confidentiality and integrity of protected information. The vulnerability is related to the generation of RSA keys using sequences of introductions with certain patterns, which introduces a side channel. **Recommendations** For GnuPG versions 1.4.5 through 1.4.15, update to version 1.4.16 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive information and physical devices to minimize the risk of exploitation. Avoid using the vulnerable GnuPG versions for sensitive operations until the issue is resolved.