Daniel Gruss

The issue is related to a timing side channel in the TCP protocol, making it easier for remote attackers to infer the content of one TCP connection from a client system to any server. This can occur when the client system is concurrently obtaining TCP data at a slow rate from an attacker-controlled server. The attack can begin by measuring RTTs via the TCP segments whose role is to provide an ACK control bit and an Acknowledgment Number.

An issue was discovered in the SCONE Confidential Computing Platform, where the lack of pointer-alignment logic in ` scone dispatch` and other entry functions allows a local attacker to access unauthorized information, also known as an "AEPIC Leak". This issue affects the Intel SGX platform.

A potential power side-channel vulnerability may allow an authenticated attacker to monitor the CPU power consumption as the data in a cache line changes over time, potentially resulting in a leak of sensitive information. The vulnerability, known as Collide+Power, can be exploited to obtain confidential data, such as passwords or encryption keys. It is estimated that almost all modern processors are affected, including those from AMD, ARM, and Intel. However, the vulnerability is considered difficult to exploit, and the speed of data leakage is relatively low, making it unlikely to be used for attacks on end-users. The vulnerability can be used to enhance other software side-channel attacks, such as PLATYPUS and Hertzbleed.

The issue is related to execution unit scheduler contention, which may lead to a side channel vulnerability. By measuring the contention level on scheduler queues, an attacker may potentially leak sensitive information. This vulnerability, known as SQUIP, affects AMD processors and allows an attacker to determine data used in other processes or virtual machines or establish a hidden communication channel between them, bypassing system access control mechanisms.

The issue is related to improper isolation of shared resources in some Intel(R) Processors, which may allow a privileged user to potentially enable information disclosure via local access. This is caused by an architectural flaw that allows access to uninitialized data left in the Advanced Programmable Interrupt Controller (APIC) registers after previous operations. The problem affects systems using the Software Guard Extensions (SGX) technology.

A timing and power-based side channel attack leveraging the x86 PREFETCH instructions on some AMD CPUs could potentially result in leaked kernel address space information. This issue is related to a Meltdown-type attack, which was initially thought not to affect AMD processors. The attack may allow an attacker to disclose kernel address space information using a side channel.

The issue allows guest OS administrators to obtain sensitive information, such as AES keys from outside the guest, via a side-channel attack on a power/energy monitoring interface, also known as a "Platypus" attack.

The issue is related to cleanup errors in some data cache evictions for some Intel(R) Processors, which may allow an authenticated user to potentially enable information disclosure via local access. This is caused by a data leak from the L1D cache. The vulnerability can be exploited to disclose protected information. Researchers have found a new speculative execution vulnerability in Intel CPUs that could let attackers leak targeted sensitive data from the OS kernel, co-resident virtual machines, and even from Intel's secured SGX enclave.

The issue is related to a logic condition in specific microprocessors that may allow an authenticated user to potentially enable partial physical address information disclosure via local access. It is also associated with a lack of protection for service data. A side-channel attack, similar to DRAM Rowhammer attacks, can be used to steal sensitive data from device memory without directly accessing it. This type of attack allows attackers to read bits from adjacent rows, and it has been demonstrated against OpenSSH, resulting in the extraction of an RSA-2048 key from memory.

The issue is related to Microarchitectural Data Sampling Uncacheable Memory (MDSUM) on some microprocessors that utilize speculative execution. This may allow an authenticated user with local access to potentially enable information disclosure via a side channel. An attacker with local access to a targeted system may exploit this issue to obtain data on the targeted system, causing some information leakage.

The issue is related to Microarchitectural Fill Buffer Data Sampling (MFBDS), which may allow an authenticated user to potentially enable information disclosure via a side channel with local access. This is due to the speculative execution utilized by some microprocessors.