Daniel Moghimi

**Nome do Software Vulnerável e Versões Afetadas** Versões do DDR5 da SK Hynix produzidas de janeiro de 2021 a dezembro de 2024 **Descrição** Existe uma vulnerabilidade na memória DDR5 da SK Hynix, permitindo que um atacante local acione inversões de bits (bit flips) do tipo Rowhammer, impactando a integridade do hardware e a segurança do sistema. O ataque, denominado "Phoenix" (CVE-2025-6202), contorna proteções existentes como Código de Correção de Erros (ECC) e Target Row Refresh (TRR). A exploração bem-sucedida pode levar a inversões de bits em até 109 segundos, potencialmente comprometendo chaves RSA, elevando privilégios para root e permitindo acesso não autorizado a dados sensíveis. O ataque envolve a manipulação dos ciclos de atualização da DRAM para alcançar inversões de bits estáveis, mesmo com medidas de proteção vigentes. A vulnerabilidade afeta sistemas DDR5 padrão de nível de produção. **Recomendações** Aumente a taxa de atualização da DRAM em três vezes (3x) para mitigar o risco de exploração.

**Name of the Vulnerable Software and Affected Versions** Intel Processors (affected versions not specified) **Description** A sequence of processor instructions can lead to unexpected behavior in some Intel processors, potentially allowing an authenticated user to enable escalation of privilege, information disclosure, or denial of service via local access. This issue is related to the interpretation of redundant prefixes and can cause the system to crash or become unresponsive. The vulnerability, termed Reptar, primarily affects multi-tenant virtualized environments where multiple virtual machines are run on the same host. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Intel Processors versions prior to the fixed version **Description** The issue is related to information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors. This may allow an authenticated user to potentially enable information disclosure via local access. The vulnerability, known as Downfall, affects Intel consumer and server processors ranging from the Skylake family to Rocket Lake. It enables a user to access and steal data from other users who share the same computer. The vulnerability is caused by memory optimization features in Intel processors that unintentionally reveal internal data. **Recommendations** To resolve the issue, update the microcode to the latest version. However, this may lead to a loss of performance. For mitigation, consider disabling the gather instruction, which is used in the Downfall attack, until a patch is available. Additionally, restrict access to sensitive data and use secure communication protocols to minimize the risk of exploitation. Note: The exact mitigation measures may vary depending on the specific system configuration and the affected Intel processor version. It is recommended to consult the official Intel documentation and security advisories for detailed guidance on resolving the issue.

**Name of the Vulnerable Software and Affected Versions** wolfSSL versions prior to 4.3.0 **Description** The issue is related to the `wc ecc mulmod ex` function, which does not properly resist side-channel attacks. **Recommendations** For versions prior to 4.3.0, update to version 4.3.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** wolfSSL versions prior to 4.3.0 **Description** The issue is related to the mishandling of calls to the `wc SignatureGenerateHash` function, which can lead to fault injection in RSA cryptography. **Recommendations** For versions prior to 4.3.0, update to version 4.3.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** wolfSSL versions prior to 4.3.0 **Description** An issue was discovered in a non-default configuration where DSA is enabled, allowing a side-channel attack against the nonce due to the use of the BEEA algorithm during modular inversion of the nonce in DSA signing. **Recommendations** For versions prior to 4.3.0, update to version 4.3.0 or later to resolve the issue. As a temporary workaround, consider disabling DSA in the configuration to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** STMicroelectronics ST33TPHF2ESPI TPM devices versions prior to 2019-09-12 **Description** The issue is related to a side-channel timing attack that allows attackers to extract the ECDSA private key due to mishandled ECDSA scalar multiplication. This vulnerability is associated with defects in the cryptographic algorithms used in the TPM processor's firmware. An attacker can exploit this issue to recover the value of closed keys stored in the Trusted Platform Module. **Recommendations** For versions prior to 2019-09-12, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Intel(R) PTT versions prior to 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.0, and 14.0.10 Intel(R) TXE versions prior to 3.1.70 and 4.0.20 Intel(R) SPS versions prior to SPS E5 04.01.04.305.0, SPS SoC-X 04.00.04.108.0, SPS SoC-A 04.00.04.191.0, SPS E3 04.01.04.086.0, and SPS E3 04.08.04.047.0 **Description** The issue is related to cryptographic timing conditions in the Intel(R) PTT, Intel(R) TXE, and Intel(R) SPS subsystems, which may allow an unauthenticated user to potentially enable information disclosure via network access. This vulnerability is associated with a lack of protection for service data and may allow a remote attacker to access cryptographic keys stored in the Trusted Platform Module (TPM). **Recommendations** For Intel(R) PTT versions prior to 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.0, and 14.0.10, update to the respective fixed versions or later. For Intel(R) TXE versions prior to 3.1.70 and 4.0.20, update to the respective fixed versions or later. For Intel(R) SPS versions prior to SPS E5 04.01.04.305.0, SPS SoC-X 04.00.04.108.0, SPS SoC-A 04.00.04.191.0, SPS E3 04.01.04.086.0, and SPS E3 04.08.04.047.0, update to the respective fixed versions or later. As a temporary workaround, consider restricting access to the Trusted Platform Module (TPM) to minimize the risk of exploitation.