Yuval Yarom

NTRU secret values are reduced using the % operator in three helper functions, which deviates from the division-free reference implementations. This results in integer divisions where latency depends on the secret operand. Specifically, the `Polynomial.modQ` function uses a variable divisor that prevents compiler strength-reduction, leading to division on every call, including the decapsulation path where the dividend is derived from the private key. Additionally, `Polynomial.mod3` and `NTRUSampling.mod3` perform divisions on secret key polynomials `f` and `g` during key generation, message polynomials `r` and `m` during encapsulation, and coefficients during decapsulation. An attacker capable of measuring these timing differences can recover information about the NTRU private key.

A logic issue was addressed with improved state management, which may allow a website to track sensitive user information. This issue is related to the WebKitGTK and WPE WebKit modules, and its exploitation can lead to the disclosure of protected information.

The issue is related to a logic condition in specific microprocessors that may allow an authenticated user to potentially enable partial physical address information disclosure via local access. It is also associated with a lack of protection for service data. A side-channel attack, similar to DRAM Rowhammer attacks, can be used to steal sensitive data from device memory without directly accessing it. This type of attack allows attackers to read bits from adjacent rows, and it has been demonstrated against OpenSSH, resulting in the extraction of an RSA-2048 key from memory.

The issue is related to the implementation of Intel Software Guard Extensions (SGX) technology and speculative execution in microprocessors. It may allow unauthorized disclosure of information from an enclave to an attacker with local user access via a side-channel analysis. This can enable an attacker to read data from the L1 cache, which may contain fragments of data from the protected area after speculative execution.

The issue makes it easier for attackers to discover a secret key due to not properly considering Curve25519 side-channel attacks, related to files cipher/ecc.c and mpi/ec.c.

The issue is related to a cache side-channel attack that can lead to a complete break of RSA-1024 and potentially RSA-2048 with increased computation. This attack requires the ability to run arbitrary software on the hardware where the private RSA key is used, allowing a local attacker to compromise data confidentiality by fully recovering the RSA key using the left-to-right method for computing the sliding-window expansion.

The issue is related to the `dsa sign setup` function in OpenSSL, which does not ensure the use of constant-time operations. This makes it easier for local users to discover a DSA private key via a timing side-channel attack. The vulnerability can allow an attacker to recover the DSA private key under certain conditions, potentially affecting SSH servers that use DSA keys.

The issue is related to the MOD EXP CTIME COPY FROM PREBUF function in OpenSSL, which does not properly consider cache-bank access times during modular exponentiation. This makes it easier for local users to discover RSA keys by running a crafted application on the same Intel Sandy Bridge CPU core as a victim and leveraging cache-bank conflicts, also known as a "CacheBleed" attack. The vulnerability allows attackers to recover RSA keys via a side-channel attack.

The issue is related to a local synchronization problem during RSA decryption in Mbed TLS, allowing a local unprivileged attacker to recover the plaintext of RSA decryption. This affects RSA-without-(EC)DH(E) cipher suites. The vulnerability can be exploited to gain access to protected information.

The issue allows local users to obtain private RSA keys via a cache side-channel attack involving the L3 cache. This can lead to a violation of confidentiality of protected information. The exploitation of the issue can be carried out locally.