Daniel Moghimi

**Name of the Vulnerable Software and Affected Versions** SK Hynix DDR5 versions produced from January 2021 through December 2024 **Description** A vulnerability exists in SK Hynix DDR5 memory, allowing a local attacker to trigger Rowhammer bit flips, impacting hardware integrity and system security. The attack, dubbed “Phoenix” (CVE-2025-6202), bypasses existing protections like Error Correction Code (ECC) and Target Row Refresh (TRR). Successful exploitation can lead to bit flips within 109 seconds, potentially compromising RSA keys, escalating privileges to root, and enabling unauthorized access to sensitive data. The attack involves manipulating DRAM refresh cycles to achieve stable bit flips, even with protective measures in place. The vulnerability affects standard production-grade DDR5 systems. **Recommendations** Increase the DRAM refresh rate threefold (3x) to mitigate the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Intel Processors (affected versions not specified) **Description** A sequence of processor instructions can lead to unexpected behavior in some Intel processors, potentially allowing an authenticated user to enable escalation of privilege, information disclosure, or denial of service via local access. This issue is related to the interpretation of redundant prefixes and can cause the system to crash or become unresponsive. The vulnerability, termed Reptar, primarily affects multi-tenant virtualized environments where multiple virtual machines are run on the same host. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Intel Processors versions prior to the fixed version **Description** The issue is related to information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors. This may allow an authenticated user to potentially enable information disclosure via local access. The vulnerability, known as Downfall, affects Intel consumer and server processors ranging from the Skylake family to Rocket Lake. It enables a user to access and steal data from other users who share the same computer. The vulnerability is caused by memory optimization features in Intel processors that unintentionally reveal internal data. **Recommendations** To resolve the issue, update the microcode to the latest version. However, this may lead to a loss of performance. For mitigation, consider disabling the gather instruction, which is used in the Downfall attack, until a patch is available. Additionally, restrict access to sensitive data and use secure communication protocols to minimize the risk of exploitation. Note: The exact mitigation measures may vary depending on the specific system configuration and the affected Intel processor version. It is recommended to consult the official Intel documentation and security advisories for detailed guidance on resolving the issue.

**Name of the Vulnerable Software and Affected Versions** wolfSSL versions prior to 4.3.0 **Description** The issue is related to the `wc ecc mulmod ex` function, which does not properly resist side-channel attacks. **Recommendations** For versions prior to 4.3.0, update to version 4.3.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** wolfSSL versions prior to 4.3.0 **Description** The issue is related to the mishandling of calls to the `wc SignatureGenerateHash` function, which can lead to fault injection in RSA cryptography. **Recommendations** For versions prior to 4.3.0, update to version 4.3.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** wolfSSL versions prior to 4.3.0 **Description** An issue was discovered in a non-default configuration where DSA is enabled, allowing a side-channel attack against the nonce due to the use of the BEEA algorithm during modular inversion of the nonce in DSA signing. **Recommendations** For versions prior to 4.3.0, update to version 4.3.0 or later to resolve the issue. As a temporary workaround, consider disabling DSA in the configuration to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** STMicroelectronics ST33TPHF2ESPI TPM devices versions prior to 2019-09-12 **Description** The issue is related to a side-channel timing attack that allows attackers to extract the ECDSA private key due to mishandled ECDSA scalar multiplication. This vulnerability is associated with defects in the cryptographic algorithms used in the TPM processor's firmware. An attacker can exploit this issue to recover the value of closed keys stored in the Trusted Platform Module. **Recommendations** For versions prior to 2019-09-12, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Intel(R) PTT versions prior to 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.0, and 14.0.10 Intel(R) TXE versions prior to 3.1.70 and 4.0.20 Intel(R) SPS versions prior to SPS E5 04.01.04.305.0, SPS SoC-X 04.00.04.108.0, SPS SoC-A 04.00.04.191.0, SPS E3 04.01.04.086.0, and SPS E3 04.08.04.047.0 **Description** The issue is related to cryptographic timing conditions in the Intel(R) PTT, Intel(R) TXE, and Intel(R) SPS subsystems, which may allow an unauthenticated user to potentially enable information disclosure via network access. This vulnerability is associated with a lack of protection for service data and may allow a remote attacker to access cryptographic keys stored in the Trusted Platform Module (TPM). **Recommendations** For Intel(R) PTT versions prior to 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.0, and 14.0.10, update to the respective fixed versions or later. For Intel(R) TXE versions prior to 3.1.70 and 4.0.20, update to the respective fixed versions or later. For Intel(R) SPS versions prior to SPS E5 04.01.04.305.0, SPS SoC-X 04.00.04.108.0, SPS SoC-A 04.00.04.191.0, SPS E3 04.01.04.086.0, and SPS E3 04.08.04.047.0, update to the respective fixed versions or later. As a temporary workaround, consider restricting access to the Trusted Platform Module (TPM) to minimize the risk of exploitation.