CVE-2022-29901 Arbitrary Memory Disclosure through CPU Side-Channel Attacks (Retbleed)

Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under...

Hertzbleed: A New Side-Channel Attack

Hertzbleed is a new side-channel attack that works against a variety of microprocressors. Deducing cryptographic keys by analyzing power consumption has long been an attack, but its not generally viable because measuring power consumption is often hard. This new attack measures power consumption ...

Hertzbleed exposes computers’ secret whispers

Hertzbleed is the name for a vulnerability that can be used to obtain cryptographic keys and other secret data from Intel and AMD CPUs, remotely. It works by monitoring changes in power consumption, which can be deduced by the careful timing of known workloads, thanks to a processor power saving...

New Hertzbleed Side Channel Attack Affects All Modern AMD and Intel CPUs

A newly discovered security vulnerability in modern Intel and AMD processors could let remote attackers steal encryption keys via a power side channel attack. Dubbed Hertzbleed by a group of researchers from the University of Texas, the University of Illinois Urbana-Champaign, and the University ...

Frequency Scaling Timing Power Side-Channels

Bulletin ID: AMD-SB-1038 Potential Impact: Information Disclosure Severity: Medium Summary AMD is aware of the academic research paper titled “Hertzbleed: Turning Power Side-Channel Attacks Into Remote Timing Attacks on x86”. AMD has been notified the researchers intend to submit their paper to...

CVE-2022-0823

An improper control of interaction frequency vulnerability in Zyxel GS1200 series switches could allow a local attacker to guess the password by using a timing side-channel attack...

CVE-2022-0823

An improper control of interaction frequency vulnerability in Zyxel GS1200 series switches could allow a local attacker to guess the password by using a timing side-channel attack...

CVE-2022-0823

An improper control of interaction frequency vulnerability in Zyxel GS1200 series switches could allow a local attacker to guess the password by using a timing side-channel attack...

Information disclosure

An improper control of interaction frequency vulnerability in Zyxel GS1200 series switches could allow a local attacker to guess the password by using a timing side-channel attack...

Zyxel GS1200 安全漏洞

The Zyxel GS1200 is a series of switches from China-based Hopkins Technology Zyxel. A security vulnerability exists in the Zyxel GS1200 series of switches that stems from an improperly controlled interaction frequency vulnerability. A local attacker can exploit the vulnerability to guess password...

CVE-2022-0823

The CVE-2022-0823 issue affects Zyxel GS1200 series switches and stems from improper control of interaction frequency, enabling a local attacker to guess passwords via a timing side-channel attack. Concrete details in connected sources confirm the affected product family and the local attack vect...

PT-2022-3215 · Zyxel · Zyxel Gs1200

Name of the Vulnerable Software and Affected Versions: Zyxel GS1200 series switches affected versions not specified Description: The issue is related to an improper control of interaction frequency, which could allow a local attacker to guess the password by using a timing side-channel attack. Th...

SUSE SLES12 Security Update : wpa_supplicant (SUSE-SU-2022:1853-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1853-1 advisory. - Multiple integer overflows in the NDEF record parser in hostapd before 2.5 and wpasupplicant before 2.5 allow remote attackers to...

SUSE-SU-2022:1853-1 Security update for wpa_supplicant

This update for wpasupplicant fixes the following issues: - CVE-2022-23303, CVE-2022-23304: Fixed SAE/EAP-pwd side-channel attacks bsc1194732, bsc1194733 - CVE-2021-0326: Fixed P2P group information processing vulnerability bsc1181777 - Fix systemd device ready dependencies in...

EulerOS 2.0 SP3 : wpa_supplicant (EulerOS-SA-2022-1771)

According to the versions of the wpasupplicant package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The implementations of SAE in hostapd before 2.10 and wpasupplicant before 2.10 are vulnerable to side channel attacks as a result of cach...

Huawei EulerOS: Security Advisory for wpa_supplicant (EulerOS-SA-2022-1771)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

wolfCrypt leaks cryptographic information via timing side channel

wolfSSL and wolfCrypt 4.0.0 and earlier when configured without --enable-fpecc, --enable-sp, or --enable-sp-math contain a timing side channel in ECDSA signature generation. This allows a local attacker, able to precisely measure the duration of signature operations, to infer information about th...

GHSA-Q95H-VC86-HV77 wolfCrypt leaks cryptographic information via timing side channel

wolfSSL and wolfCrypt 4.0.0 and earlier when configured without --enable-fpecc, --enable-sp, or --enable-sp-math contain a timing side channel in ECDSA signature generation. This allows a local attacker, able to precisely measure the duration of signature operations, to infer information about th...

CVE-2022-24043

A vulnerability has been identified in Desigo DXR2 All versions V01.21.142.5-22, Desigo PXC3 All versions V01.21.142.4-18, Desigo PXC4 All versions V02.20.142.10-10884, Desigo PXC5 All versions V02.20.142.10-10884. The login functionality of the application fails to normalize the response times o...

CVE-2022-24043

A vulnerability has been identified in Desigo DXR2 All versions V01.21.142.5-22, Desigo PXC3 All versions V01.21.142.4-18, Desigo PXC4 All versions V02.20.142.10-10884, Desigo PXC5 All versions V02.20.142.10-10884. The login functionality of the application fails to normalize the response times o...