Scalar-Venom-Attack

本文分析了现代加密密钥管理基础设施中发现的加密漏洞，特别关注硬件安全模块（HSM）在处理椭圆曲线私钥时架构中的关键缺陷。研究聚焦于一类利用认证加密设备中隔离不充分的RAM管理的攻击。在现代比特币加密生态系统中，私钥安全是保护全球价值数万亿美元数字资产的基本要求。经FIPS 140-2标准认证的硬件安全模块（HSM）传统上被认为通过硬件级隔离和严格的内存管理协议为加密密钥提供无法穿透的保护。然而，F5OS-A FIPS HSM模块中关键漏洞CVE-2025-60013 的发现，结合Scalar Venom Attack 类攻击（也称为Scalar Poison、Memory Phantom...

K000159896: Golang vulnerability CVE-2025-61723

Security Advisory Description The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs. CVE-2025-61723 Impact An attacker may be able to exploit this vulnerability, causing the affected...

F5 Networks F5OS-A/F5OS-C Multiple Vulnerabilities (K000156767, K000156771, K000156796)

The version of F5 Networks F5OS-A or F5OS-C installed on the remote host is affected by a vulnerability as referenced in the K000156767, K000156771 and K000156796 security advisories. - A vulnerability exists in F5OS-A and F5OS-C systems that may allow an authenticated attacker with local access ...

F5 Networks F5OS-A FIPS HSM Password Initialization (K000154661)

The version of F5 Networks F5OS-A installed on the remote host is affected by a vulnerability as referenced in the K000154661 advisory. - When a user attempts to initialize the rSeries FIPS module using a password with special shell metacharacters, the FIPS hardware security module HSM may fail t...

CVE-2025-57780

A vulnerability exists in F5OS-A and F5OS-C system that may allow an authenticated attacker with local access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support EoTS are not...

CVE-2025-60015

An out-of-bounds write vulnerability exists in F5OS-A and F5OS-C that could lead to memory corruption. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-57780

A vulnerability exists in F5OS-A and F5OS-C system that may allow an authenticated attacker with local access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support EoTS are not...

CVE-2025-57780

CVE-2025-57780 affects F5OS-A and F5OS-C. An authenticated attacker with local access can escalate privileges, potentially bypassing Appliance mode and execute arbitrary system commands with higher privileges (control plane issue). Severity is high (CVSSv3.1 up to 7.8 standard, 8.8 appliance). Re...

CVE-2025-57780 F5OS Vulnerability

A vulnerability exists in F5OS-A and F5OS-C system that may allow an authenticated attacker with local access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support EoTS are not...

CVE-2025-57780 F5OS Vulnerability

A vulnerability exists in F5OS-A and F5OS-C system that may allow an authenticated attacker with local access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support EoTS are not...

CVE-2025-53860 F5OS-A FIPS HSM vulnerability

A vulnerability exists in F5OS-A software that allows a highly privileged authenticated attacker to access sensitive FIPS hardware security module HSM information on F5 rSeries systems. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-61955

A vulnerability exists in F5OS-A and F5OS-C systems that may allow an authenticated attacker with local access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support EoTS are not...

CVE-2025-60015

An out-of-bounds write vulnerability exists in F5OS-A and F5OS-C that could lead to memory corruption. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-61955

A vulnerability exists in F5OS-A and F5OS-C systems that may allow an authenticated attacker with local access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support EoTS are not...

CVE-2025-60015

An out-of-bounds write vulnerability exists in F5OS-A and F5OS-C that could lead to memory corruption. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-60015

The CVE-2025-60015 issue affects F5OS-A and F5OS-C with an out-of-bounds write leading to memory corruption. Per the F5 advisory, vulnerable versions include F5OS-A 1.8.03 and 1.5.1–1.5.3, plus F5OS-C 1.8.0–1.8.1 and 1.6.0–1.6.23. Remediation is available via updates: F5OS-A to 1.8.3 (and later),...

CVE-2025-61955 F5OS vulnerability

A vulnerability exists in F5OS-A and F5OS-C systems that may allow an authenticated attacker with local access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support EoTS are not...

CVE-2025-61955 F5OS vulnerability

A vulnerability exists in F5OS-A and F5OS-C systems that may allow an authenticated attacker with local access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support EoTS are not...

CVE-2025-60013

CVE-2025-60013 affects F5OS-A FIPS HSM password initialization. A highly privileged, authenticated attacker could use a password with special shell metacharacters to initialise the rSeries FIPS module, potentially executing arbitrary system commands and crossing a security boundary. Affected hard...

K000148625: F5OS-A FIPS HSM vulnerability CVE-2025-53860

Security Advisory Description A vulnerability exists in F5OS-A software that allows a highly privileged authenticated attacker to access sensitive FIPS hardware security module HSM information on F5 rSeries systems. CVE-2025-53860 Impact A highly privileged authenticated attacker with access to t...