Advisory 2022-1233 - Processors: Vulnerability allows information disclosure and cryptography bypass
The CTI portal is available at the following address: https://cti-portal.telekom.net/advisories/2022-1233
3 |
|
5 |
|
- Date
- 2022-06-15
- Release
- 2025-02-07 UPDATE
Operating System
- Hardware Appliance
Software
- AMD Prozessor
- Intel Prozessor
- Lenovo Computer
- UPDATE 2025-02-07
- F5 BIG-IP
Attack
A remote authenticated attacker can exploit multiple vulnerabilities in AMD and Intel Processors in order to disclose information and thereby bypass cryptographic security measures.
Description
Processors are the central processing units of a computer.
CVE-2022-23823, CVE-2022-24436
There is a vulnerability in AMD and Intel Processors that enables several side-channel attacks. The behaviour of the CPU's dynamic frequency scaling / throttling functionality can be observed remotely, allowing a local or remote attacker to reconstruct (disclose) data that has been processed in certain cases. Researchers demonstrated a full cryptographic key extraction against the SIKE key exchange mechanisms, effectively allowing the attacker to bypass this cryptographic protection.
PoC code taking advantage of the vulnerabilities CVE-2022-23823 and CVE-2022-24436 is available on the Internet.
Recommendation
AMD and Intel provide guidance for developers of cryptographic algorithms on how to deal with this vulnerability. Please consult the vendor advisory for more information.
https://www.hertzbleed.com/
Lenovo provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://support.lenovo.com/de/de/product_security/ps500001-lenovo-product-security-advisories
At present no update or patch for the removal of this vulnerability is available.
https://www.hertzbleed.com/
UPDATE 2025-02-07
F5 provides information
https://my.f5.com/manage/s/article/K14335949
https://my.f5.com/manage/s/article/K43357358
Information
Hertzbleed Attack website dated 2022-06-14
https://www.hertzbleed.com/
AMD Security Bulletin AMD-SB-1038 dated 2022-06-14
https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1038
Intel Security Advisory INTEL-SA-00698 dated 2022-06-14
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00698.html
Hertzbleed PoC
https://github.com/FPSG-UIUC/hertzbleed
Lenovo Security Advisory
https://support.lenovo.com/de/de/product_security/ps500001-lenovo-product-security-advisories
F5 Security Advisory K14335949 dated 2025-02-06
https://my.f5.com/manage/s/article/K14335949
F5 Security Advisory K43357358 dated 2025-02-06
https://my.f5.com/manage/s/article/K43357358
References
AMD:AMD-SB-1038CVE:CVE-2022-23823
CVE:CVE-2022-24436
F5:K14335949
F5:K43357358
INTEL:INTEL-SA-00698
LENOVO:LEN-90920
VULNAME:HERTZBLEED
Disclaimer
*The probability of an attack is determined by the attacker's motivation, the necessary expend and the possibilities for an attack. The damage probability is determined by the expend needed to resolute the attack and probable indirect consequences of an attack for business processes. Telekom Security assumes worst case scenarios.
Copyright © 1999-2026 Deutsche Telekom Security GmbH. All rights reserved. Reproduction and distribution of this publication in any form - even in parts - without prior written permission is forbidden.
The information contained herein has been obtained from sources believed to be reliable and trusted or have been verified. Telekom Security can take liability for completeness, accuracy and correctness only in so far, as gross negligence or intention create liability. Any liability beyond it, in particular possible damages resulting from using or non-usability of the information contained herein, is excluded.