SILENT: a New Lens on Statistics in Software Timing Side Channels

Cryptographic research takes software timing side channels seriously. Approaches to mitigate them include constant-time coding and techniques to enforce such practices. However, recent attacks like Meltdown 42, Spectre 37, and Hertzbleed 70 have challenged our understanding of what it means for...

Performance Analysis of MDI-QKD in Thermal-Loss and Phase Noise Channels

Measurement-device-independent quantum key distribution MDI-QKD, enhances quantum cryptography by mitigating detector-side vulnerabilities. This study analyzes MDI-QKD performance in thermal-loss and phase noise channels, modeled as depolarizing and dephasing channels to capture thermal and phase...

Cybersquatting in Web3: the Case of NFT

Cybersquatting refers to the practice where attackers register a domain name similar to a legitimate one to confuse users for illegal gains. With the growth of the Non-Fungible Token NFT ecosystem, there are indications that cybersquatting tactics have evolved from targeting domain names to NFTs...

PT-2025-20525

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the igc driver in the Linux kernel, where writing to clear the PTM status 'valid' bit while the PTM cycle is triggered results in unreliable PTM operation. This c...

Security Theater: Vanity Metrics Keep You Busy - and Exposed

After more than 25 years of mitigating risks, ensuring compliance, and building robust security programs for Fortune 500 companies, I've learned that looking busy isn't the same as being secure. It's an easy trap for busy cybersecurity leaders to fall into. We rely on metrics that tell a story of...

RLSA-2025:0161 Important: iperf3 security update

Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss. Security Fixes: iperf: Denial of Service in iperf Due to Improper JSON Handling CVE-2024-53580 For more details about the securit...

GHSA-Q65W-FG65-79F4 Post-Quantum Secure Feldman's Verifiable Secret Sharing has Timing Side-Channels in Matrix Operations

Description: The feldmanvss library contains timing side-channel vulnerabilities in its matrix operations, specifically within the findsecurepivot function and potentially other parts of securematrixsolve. These vulnerabilities are due to Python's execution model, which does not guarantee...

CVE-2025-29780

CVE-2025-29780 affects the Python implementation of Post-Quantum Secure Feldman's Verifiable Secret Sharing (VSS) in the feldman_vss library, version 0.8.0b2 and earlier. Connected sources describe timing side-channel vulnerabilities in matrix operations, specifically in _find_secure_pivot and po...

iio: imu: kmx61: fix information leak in triggered buffer

...

PT-2025-22230

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A potential lockup issue in the Linux kernel has been identified and resolved. The problem occurs in the st lsm6dsx read tagged fifo function when pattern len is equal to zero and the...

SUSE CVE-2022-49627

In the Linux kernel, the following vulnerability has been resolved: ima: Fix potential memory leak in imainitcrypto On failure to allocate the SHA1 tfm, IMA fails to initialize and exits without freeing the imaalgoarray. Add the missing kfree for imaalgoarray to avoid the potential memory leak...

DEBIAN-CVE-2022-49643

In the Linux kernel, the following vulnerability has been resolved: ima: Fix a potential integer overflow in imaappraisemeasurement When the ima-modsig is enabled, the rc passed to evmverifyxattr may be negative, which may cause the integer overflow problem...

DEBIAN-CVE-2022-49627

In the Linux kernel, the following vulnerability has been resolved: ima: Fix potential memory leak in imainitcrypto On failure to allocate the SHA1 tfm, IMA fails to initialize and exits without freeing the imaalgoarray. Add the missing kfree for imaalgoarray to avoid the potential memory leak...

UBUNTU-CVE-2022-49643

In the Linux kernel, the following vulnerability has been resolved: ima: Fix a potential integer overflow in imaappraisemeasurement When the ima-modsig is enabled, the rc passed to evmverifyxattr may be negative, which may cause the integer overflow problem...

UBUNTU-CVE-2022-49627

In the Linux kernel, the following vulnerability has been resolved: ima: Fix potential memory leak in imainitcrypto On failure to allocate the SHA1 tfm, IMA fails to initialize and exits without freeing the imaalgoarray. Add the missing kfree for imaalgoarray to avoid the potential memory leak...

CVE-2022-49643 ima: Fix a potential integer overflow in ima_appraise_measurement

In the Linux kernel, the following vulnerability has been resolved: ima: Fix a potential integer overflow in imaappraisemeasurement When the ima-modsig is enabled, the rc passed to evmverifyxattr may be negative, which may cause the integer overflow problem...

CVE-2022-49266

In the Linux kernel, the following vulnerability has been resolved: block: fix rq-qos breakage from skipping rqqosdonebio a647a524a467 "block: don't call rqqosops-donebio if the bio isn't tracked" made bioendio skip rqqosdonebio if BIOTRACKED is not set. While this fixed a potential oops, it also...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that originates from an integer overflow in the imaappraisemeasurement function...

Qardio Heart Health 安全漏洞

Qardio Heart Health is a heart monitoring management software from Qardio, Inc. in the United States. A security vulnerability exists in Qardio Heart Health that stems from the use of a specially crafted Python script that sends successive startMeasurement commands to an affected device over an...

[SECURITY] Fedora 41 Update: keyring-ima-signer-0.1.0-17.fc41

The IMA Integrity Measurement Architecture is a key component of the Linux integrity subsystem designed to ensure integrity, authenticity, and confidentiality of systems including hardware root of trusts TPM. This tool allows signing of files in userspace, inclusding options of including the...