Brand ClaimErleben, was verbindet

Information on the use of cookies

This website uses only the technically necessary cookies to provide you with the best possible service.
Your session is identified by a so-called session cookie in order to maintain your language choice and to allow a comfortable form use. Furthermore, a login is only possible by using a cookie.
Further information can be found in the data protection information.

Accept

Advisory 2022-1233 - Processors: Vulnerability allows information disclosure and cryptography bypass

Notice: You can now also find information from the Vulnerability Advisory Service in the CTI portal!
The CTI portal is available at the following address: https://cti-portal.telekom.net/advisories/2022-1233
Notice: This advisory is by exception shown completely public. You will regularly receive details on vulnerability information as a customer via your login or through our daily advisory e-mail.
3
Attack probability
medium
5
Potential damage
high
remote authenticated attackerExploit available
Date
2022-06-15
Release
2025-02-07 UPDATE

Operating System

  • Hardware Appliance

Software

  • AMD Prozessor
  • Intel Prozessor
  • Lenovo Computer
  • UPDATE 2025-02-07
  • F5 BIG-IP

Attack

A remote authenticated attacker can exploit multiple vulnerabilities in AMD and Intel Processors in order to disclose information and thereby bypass cryptographic security measures.

Description

Processors are the central processing units of a computer.

CVE-2022-23823, CVE-2022-24436

There is a vulnerability in AMD and Intel Processors that enables several side-channel attacks. The behaviour of the CPU's dynamic frequency scaling / throttling functionality can be observed remotely, allowing a local or remote attacker to reconstruct (disclose) data that has been processed in certain cases. Researchers demonstrated a full cryptographic key extraction against the SIKE key exchange mechanisms, effectively allowing the attacker to bypass this cryptographic protection.

CVSSv2 Base Score: 4.9 / Temporal Score: 4.2
AV:N/AC:H/AU:S/C:C/I:N/A:N/E:POC/RL:W/RC:ND
CVSSv3.1 Base Score: 6.3 / Temporal Score: 5.8
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N/E:P/RL:W/RC:X

PoC code taking advantage of the vulnerabilities CVE-2022-23823 and CVE-2022-24436 is available on the Internet.

Recommendation

AMD and Intel provide guidance for developers of cryptographic algorithms on how to deal with this vulnerability. Please consult the vendor advisory for more information.
https://www.hertzbleed.com/

Lenovo provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://support.lenovo.com/de/de/product_security/ps500001-lenovo-product-security-advisories

At present no update or patch for the removal of this vulnerability is available.
https://www.hertzbleed.com/

UPDATE 2025-02-07

F5 provides information
https://my.f5.com/manage/s/article/K14335949
https://my.f5.com/manage/s/article/K43357358

Information

Hertzbleed Attack website dated 2022-06-14
https://www.hertzbleed.com/

AMD Security Bulletin AMD-SB-1038 dated 2022-06-14
https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1038

Intel Security Advisory INTEL-SA-00698 dated 2022-06-14
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00698.html

Hertzbleed PoC
https://github.com/FPSG-UIUC/hertzbleed

Lenovo Security Advisory
https://support.lenovo.com/de/de/product_security/ps500001-lenovo-product-security-advisories

UPDATE 2025-02-07

F5 Security Advisory K14335949 dated 2025-02-06
https://my.f5.com/manage/s/article/K14335949

F5 Security Advisory K43357358 dated 2025-02-06
https://my.f5.com/manage/s/article/K43357358

References

AMD:AMD-SB-1038
CVE:CVE-2022-23823
CVE:CVE-2022-24436
F5:K14335949
F5:K43357358
INTEL:INTEL-SA-00698
LENOVO:LEN-90920
VULNAME:HERTZBLEED

Disclaimer

*The probability of an attack is determined by the attacker's motivation, the necessary expend and the possibilities for an attack. The damage probability is determined by the expend needed to resolute the attack and probable indirect consequences of an attack for business processes. Telekom Security assumes worst case scenarios.

Copyright © 1999-2026 Deutsche Telekom Security GmbH. All rights reserved. Reproduction and distribution of this publication in any form - even in parts - without prior written permission is forbidden.

The information contained herein has been obtained from sources believed to be reliable and trusted or have been verified. Telekom Security can take liability for completeness, accuracy and correctness only in so far, as gross negligence or intention create liability. Any liability beyond it, in particular possible damages resulting from using or non-usability of the information contained herein, is excluded.