hw: Information disclosure issue in Intel SGX via RAPL interface

A vulnerability was found in Intel's implementation of RAPL Running Average Power Limit. An attacker with a local account could query the power management functionality to intelligently infer SGX enclave computation values by measuring power usage in the RAPL subsystem...

IoT security: how Microsoft protects Azure Datacenters

Azure Sphere first entered the IoT Security market in 2018 with a clear mission—to empower every organization on the planet to connect and create secure and trustworthy IoT devices. Security is the foundation for durable innovation and business resilience. Every industry investing in IoT must...

ZDCC VisualField suffers from localized power lifting vulnerability

VisualField VF for short system software is a software package for control system configuration and monitoring for the ECS-700 system. ZDCC VisualField is vulnerable to a local power lifting vulnerability that can be exploited by an attacker to gain control of the server...

DEBIAN-CVE-2020-4788

IBM Power9 AIX 7.1, 7.2, and VIOS 3.1 processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances. IBM X-Force ID: 189296...

Command Execution Vulnerability in Netnifty Power V6000-F2310 (CNVD-2020-69492)

Power V6000-F2310 is a Netnifty Firewall. A command execution vulnerability exists in the Netnifty Power V6000-F2310, which can be exploited by an attacker to gain control of a server...

Command Execution Vulnerability in Netnifty Power V6000-F2310

Power V6000-F2310 is a Netnifty Firewall. A command execution vulnerability exists in the Netnifty Power V6000-F2310, which can be exploited by an attacker to gain control of a server...

Fedora 32 : xen (2020-2684e0fadd)

Information leak via power sidechannel XSA-351 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C...

UBUNTU-CVE-2020-4788

IBM Power9 AIX 7.1, 7.2, and VIOS 3.1 processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances. IBM X-Force ID: 189296...

IBM i 安全漏洞

The IBM Power System is a Power processor-based server computer from IBM in the United States. A security vulnerability exists in IBM Power9 processor, which can be exploited by an attacker to obtain sensitive information from data in the L1 cache under the right circumstances...

CentOS: Security Advisory for fence-agents-aliyun (CESA-2020:5003)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

fence security update

CentOS Errata and Security Advisory CESA-2020:5003 An update for fence-agents is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Security Updates for Windows 10 / Windows Server 2016 / Windows Server 2019 (November 2020)

The remote Windows host is missing a security update. It is, therefore, missing microcode updates to address the following vulnerabilities: - Microarchitectural Store Buffer Data Sampling MSBDS CVE-2018-12126. - Microarchitectural Load Port Data Sampling CVE-2018-12127 - Intel® Running Average...

Brute forcing device passwords

When working with IoT and embedded systems, brute-force password guessing attacks are an effective tool to gain access. Over the years, I’ve learned some tips and tricks to make these attacks more effective. What is brute forcing? Very simply, it’s guessing passwords so that you can find a valid...

Intel(R) Processors PMC Elevation of Privilege Vulnerability

Intel Power Management Controller Intel PMC is a built-in program for power control from Intel Corporation USA. An elevation of privilege vulnerability exists in IntelR Processors PMC that stems from improper access control that could allow a privileged user to potentially enable privilege...

Friday Squid Blogging: Underwater Robot Uses Squid-Like Propulsion

This is neat: By generating powerful streams of water, UCSDs squid-like robot can swim untethered. The "squidbot" carries its own power source, and has the room to hold more, including a sensor or camera for underwater exploration. As usual, you can also use this squid post to talk about the...

Xen Platypus information leak via power sidechannel (XSA-351)

An information disclosure vulnerability exists in power/energy monitoring interfaces, which can be used to create covert channels and infer the operations and data used by other contexts within the system. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid142889;...

CVE-2020-12912

A potential vulnerability in the AMD extension to Linux "hwmon" service may allow an attacker to use the Linux-based Running Average Power Limit RAPL interface to show various side channel attacks. In line with industry partners, AMD has updated the RAPL interface to require privileged access...

UBUNTU-CVE-2020-12912

A potential vulnerability in the AMD extension to Linux "hwmon" service may allow an attacker to use the Linux-based Running Average Power Limit RAPL interface to show various side channel attacks. In line with industry partners, AMD has updated the RAPL interface to require privileged access...

CVE-2020-28368

A flaw was found in Xen where access to power/energy monitoring interfaces was not properly restricted to privileged software. This flaw allows an unprivileged guest administrator to create covert channels and infer the operations or data used by other contexts within the system, such as AES keys...

USN-4628-2: Intel Microcode regression

USN-4628-1 provided updated Intel Processor Microcode. Unfortunately, that update prevented certain processors in the Intel Tiger Lake family from booting successfully. This update reverts the microcode update for the Tiger Lake processor family. Please note that the 'disucodeldr' kernel command...