Daniel Gruss

**Name of the Vulnerable Software and Affected Versions** TCP protocol (affected versions not specified) **Description** The issue is related to a timing side channel in the TCP protocol, making it easier for remote attackers to infer the content of one TCP connection from a client system to any server. This can occur when the client system is concurrently obtaining TCP data at a slow rate from an attacker-controlled server. The attack can begin by measuring RTTs via the TCP segments whose role is to provide an ACK control bit and an Acknowledgment Number. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SCONE Confidential Computing Platform versions prior to 5.8.0 **Description** An issue was discovered in the SCONE Confidential Computing Platform, where the lack of pointer-alignment logic in ` scone dispatch` and other entry functions allows a local attacker to access unauthorized information, also known as an "AEPIC Leak". This issue affects the Intel SGX platform. **Recommendations** For versions prior to 5.8.0, update to version 5.8.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the ` scone dispatch` function and other affected entry functions until a patch is available.

**Name of the Vulnerable Software and Affected Versions** AMD processors (affected versions not specified) ARM processors (affected versions not specified) Intel processors (affected versions not specified) **Description** A potential power side-channel vulnerability may allow an authenticated attacker to monitor the CPU power consumption as the data in a cache line changes over time, potentially resulting in a leak of sensitive information. The vulnerability, known as Collide+Power, can be exploited to obtain confidential data, such as passwords or encryption keys. It is estimated that almost all modern processors are affected, including those from AMD, ARM, and Intel. However, the vulnerability is considered difficult to exploit, and the speed of data leakage is relatively low, making it unlikely to be used for attacks on end-users. The vulnerability can be used to enhance other software side-channel attacks, such as PLATYPUS and Hertzbleed. **Recommendations** As a temporary workaround, consider disabling the performance enhancement features in affected processors to minimize the risk of exploitation. Restrict access to sensitive data and confidential information to prevent potential leaks. Avoid using vulnerable processors for sensitive applications until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AMD CPU microarchitectures codenamed “Zen 1”, “Zen 2” and “Zen 3” that use simultaneous multithreading (SMT) **Description** The issue is related to execution unit scheduler contention, which may lead to a side channel vulnerability. By measuring the contention level on scheduler queues, an attacker may potentially leak sensitive information. This vulnerability, known as SQUIP, affects AMD processors and allows an attacker to determine data used in other processes or virtual machines or establish a hidden communication channel between them, bypassing system access control mechanisms. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Intel(R) Processors versions 10 through 12 Intel(R) Processors (affected versions not specified) **Description** The issue is related to improper isolation of shared resources in some Intel(R) Processors, which may allow a privileged user to potentially enable information disclosure via local access. This is caused by an architectural flaw that allows access to uninitialized data left in the Advanced Programmable Interrupt Controller (APIC) registers after previous operations. The problem affects systems using the Software Guard Extensions (SGX) technology. **Recommendations** For Intel(R) Processors versions 10 through 12: Update microcode packages to fix the security vulnerability. For Intel(R) Processors (affected versions not specified): At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AMD CPUs (affected versions not specified) **Description** A timing and power-based side channel attack leveraging the x86 PREFETCH instructions on some AMD CPUs could potentially result in leaked kernel address space information. This issue is related to a Meltdown-type attack, which was initially thought not to affect AMD processors. The attack may allow an attacker to disclose kernel address space information using a side channel. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Xen versions through 4.14.x **Description** The issue allows guest OS administrators to obtain sensitive information, such as AES keys from outside the guest, via a side-channel attack on a power/energy monitoring interface, also known as a "Platypus" attack. **Recommendations** To resolve the issue, change the access control for each power/energy monitoring interface in Xen.

**Name of the Vulnerable Software and Affected Versions** Intel(R) Processors (affected versions not specified) **Description** The issue is related to cleanup errors in some data cache evictions for some Intel(R) Processors, which may allow an authenticated user to potentially enable information disclosure via local access. This is caused by a data leak from the L1D cache. The vulnerability can be exploited to disclose protected information. Researchers have found a new speculative execution vulnerability in Intel CPUs that could let attackers leak targeted sensitive data from the OS kernel, co-resident virtual machines, and even from Intel's secured SGX enclave. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Intel microprocessors (affected versions not specified) **Description** The issue is related to a logic condition in specific microprocessors that may allow an authenticated user to potentially enable partial physical address information disclosure via local access. It is also associated with a lack of protection for service data. A side-channel attack, similar to DRAM Rowhammer attacks, can be used to steal sensitive data from device memory without directly accessing it. This type of attack allows attackers to read bits from adjacent rows, and it has been demonstrated against OpenSSH, resulting in the extraction of an RSA-2048 key from memory. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Intel microprocessors (affected versions not specified) vCenter Server (affected versions not specified) ESXi (affected versions not specified) Workstation (affected versions not specified) Fusion (affected versions not specified) **Description** The issue is related to Microarchitectural Data Sampling Uncacheable Memory (MDSUM) on some microprocessors that utilize speculative execution. This may allow an authenticated user with local access to potentially enable information disclosure via a side channel. An attacker with local access to a targeted system may exploit this issue to obtain data on the targeted system, causing some information leakage. **Recommendations** For Intel microprocessors, apply the microcode updates as guided by Intel. For vCenter Server, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For ESXi, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For Workstation, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For Fusion, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities.

**Name of the Vulnerable Software and Affected Versions** Intel Microprocessors (affected versions not specified) vCenter Server (affected versions not specified) ESXi (affected versions not specified) Workstation (affected versions not specified) Fusion (affected versions not specified) **Description** The issue is related to Microarchitectural Fill Buffer Data Sampling (MFBDS), which may allow an authenticated user to potentially enable information disclosure via a side channel with local access. This is due to the speculative execution utilized by some microprocessors. **Recommendations** For Intel Microprocessors, consider applying the microcode updates as guided by Intel to mitigate the risk. For vCenter Server, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For ESXi, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For Workstation, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For Fusion, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities.