Yuval Yarom

**Name of the Vulnerable Software and Affected Versions** Safari versions prior to 16.6 watchOS versions prior to 9.6 iOS versions prior to 15.7.8 and prior to 16.6 iPadOS versions prior to 15.7.8 and prior to 16.6 tvOS versions prior to 16.6 macOS Ventura versions prior to 13.5 **Description** A logic issue was addressed with improved state management, which may allow a website to track sensitive user information. This issue is related to the WebKitGTK and WPE WebKit modules, and its exploitation can lead to the disclosure of protected information. **Recommendations** For Safari versions prior to 16.6, update to Safari 16.6 or later. For watchOS versions prior to 9.6, update to watchOS 9.6 or later. For iOS versions prior to 15.7.8, update to iOS 15.7.8 or later. For iOS versions prior to 16.6, update to iOS 16.6 or later. For iPadOS versions prior to 15.7.8, update to iPadOS 15.7.8 or later. For iPadOS versions prior to 16.6, update to iPadOS 16.6 or later. For tvOS versions prior to 16.6, update to tvOS 16.6 or later. For macOS Ventura versions prior to 13.5, update to macOS Ventura 13.5 or later.

**Name of the Vulnerable Software and Affected Versions** Intel microprocessors (affected versions not specified) **Description** The issue is related to a logic condition in specific microprocessors that may allow an authenticated user to potentially enable partial physical address information disclosure via local access. It is also associated with a lack of protection for service data. A side-channel attack, similar to DRAM Rowhammer attacks, can be used to steal sensitive data from device memory without directly accessing it. This type of attack allows attackers to read bits from adjacent rows, and it has been demonstrated against OpenSSH, resulting in the extraction of an RSA-2048 key from memory. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Intel SGX (affected versions not specified) Huawei VRP (affected versions not specified) **Description** The issue is related to the implementation of Intel Software Guard Extensions (SGX) technology and speculative execution in microprocessors. It may allow unauthorized disclosure of information from an enclave to an attacker with local user access via a side-channel analysis. This can enable an attacker to read data from the L1 cache, which may contain fragments of data from the protected area after speculative execution. **Recommendations** For Intel SGX, consider disabling speculative execution as a temporary workaround until a patch is available. For Huawei VRP, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Libgcrypt versions prior to 1.8.1 **Description** The issue makes it easier for attackers to discover a secret key due to not properly considering Curve25519 side-channel attacks, related to files cipher/ecc.c and mpi/ec.c. **Recommendations** For versions prior to 1.8.1, update to version 1.8.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** libgcrypt versions prior to 1.7.8 **Description** The issue is related to a cache side-channel attack that can lead to a complete break of RSA-1024 and potentially RSA-2048 with increased computation. This attack requires the ability to run arbitrary software on the hardware where the private RSA key is used, allowing a local attacker to compromise data confidentiality by fully recovering the RSA key using the left-to-right method for computing the sliding-window expansion. **Recommendations** For libgcrypt versions prior to 1.7.8, update to version 1.7.8 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** OpenSSL versions 1.0.2h and earlier **Description** The issue is related to the `dsa sign setup` function in OpenSSL, which does not ensure the use of constant-time operations. This makes it easier for local users to discover a DSA private key via a timing side-channel attack. The vulnerability can allow an attacker to recover the DSA private key under certain conditions, potentially affecting SSH servers that use DSA keys. **Recommendations** For OpenSSL versions 1.0.2h and earlier, consider upgrading to a version that addresses this issue, as the current version does not properly ensure the use of constant-time operations, making it vulnerable to timing side-channel attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenSSL versions 1.0.1 through 1.0.1s OpenSSL versions 1.0.2 through 1.0.2g **Description** The issue is related to the MOD EXP CTIME COPY FROM PREBUF function in OpenSSL, which does not properly consider cache-bank access times during modular exponentiation. This makes it easier for local users to discover RSA keys by running a crafted application on the same Intel Sandy Bridge CPU core as a victim and leveraging cache-bank conflicts, also known as a "CacheBleed" attack. The vulnerability allows attackers to recover RSA keys via a side-channel attack. **Recommendations** For OpenSSL versions 1.0.1 through 1.0.1s, update to version 1.0.1s or later. For OpenSSL versions 1.0.2 through 1.0.2g, update to version 1.0.2g or later. As a temporary workaround, consider restricting access to the MOD EXP CTIME COPY FROM PREBUF function until a patch is available. Avoid using the `MOD EXP CTIME COPY FROM PREBUF` function in the affected OpenSSL versions until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Mbed TLS versions prior to 2.14.1 Mbed TLS versions prior to 2.7.8 Mbed TLS versions prior to 2.1.17 **Description** The issue is related to a local synchronization problem during RSA decryption in Mbed TLS, allowing a local unprivileged attacker to recover the plaintext of RSA decryption. This affects RSA-without-(EC)DH(E) cipher suites. The vulnerability can be exploited to gain access to protected information. **Recommendations** For versions prior to 2.14.1, update to version 2.14.1 or later. For versions prior to 2.7.8, update to version 2.7.8 or later. For versions prior to 2.1.17, update to version 2.1.17 or later.

**Name of the Vulnerable Software and Affected Versions** libgcrypt versions 1.4.4 through 1.4.5 libgcrypt-devel versions 1.4.4 through 1.4.5 libgcrypt-debuginfo versions 1.4.4 through 1.4.5 GnuPG versions prior to 1.4.14 Libgcrypt versions prior to 1.5.3 **Description** The issue allows local users to obtain private RSA keys via a cache side-channel attack involving the L3 cache. This can lead to a violation of confidentiality of protected information. The exploitation of the issue can be carried out locally. **Recommendations** For libgcrypt versions 1.4.4 through 1.4.5, consider updating to a version prior to the vulnerability, such as libgcrypt version 1.5.3 or later. For libgcrypt-devel versions 1.4.4 through 1.4.5, consider updating to a version prior to the vulnerability, such as libgcrypt version 1.5.3 or later. For libgcrypt-debuginfo versions 1.4.4 through 1.4.5, consider updating to a version prior to the vulnerability, such as libgcrypt version 1.5.3 or later. For GnuPG versions prior to 1.4.14, consider updating to GnuPG version 1.4.14 or later. For Libgcrypt versions prior to 1.5.3, consider updating to Libgcrypt version 1.5.3 or later. As a temporary workaround, consider restricting access to sensitive information until a patch is available.