Fallos del tipo CWE-1300

35 resultados

Vazamento de informação por canal lateral

Ocorre quando a implementação de uma função criptográfica ou autenticação vazaza informações sensíveis através de observáveis indiretos como tempo de execução, consumo de energia, radiação eletromagnética ou padrões de acesso à memória. Um atacante consegue inferir dados secretos (chaves, senhas, tokens) sem quebrar a criptografia em si, apenas medindo esses efeitos colaterais.

Ejemplo

Uma função de comparação de senha que faz loop byte a byte e sai cedo quando encontra o primeiro byte diferente: um atacante pode medir o tempo de resposta e deduzir qual é o prefixo correto da senha, testando caractere por caractere. Outro caso clássico: uma multiplicação modular em RSA que leva tempo proporcional ao número de bits 1 na chave privada.

Cómo mitigar

Use funções de comparação constante (timing-safe) para dados sensíveis. Implemente operações criptográficas com tempo de execução fixo, sem branches ou loops dependentes de dados secretos. Considere usar bibliotecas auditadas (libsodium, OpenSSL com proteções) ao invés de implementações próprias.

CVE-2025-11210MEDIUMSide-channel information leakage in Tab in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in EPSS 0.2%CVE-2026-17914MEDIUMSide-channel information leakage in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive iEPSS 0.2%CVE-2026-17978MEDIUMSide-channel information leakage in WebCodecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitEPSS 0.2%CVE-2026-14012MEDIUMSide-channel information leakage in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive inEPSS 0.2%CVE-2026-17942MEDIUMSide-channel information leakage in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crEPSS 0.2%CVE-2026-17802MEDIUMSide-channel information leakage in GPU in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin daEPSS 0.2%CVE-2026-11289MEDIUMSide-channel information leakage in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a EPSS 0.2%CVE-2026-17907MEDIUMSide-channel information leakage in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via EPSS 0.2%CVE-2026-8562MEDIUMSide-channel information leakage in Navigation in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to leak cross-origin data EPSS 0.2%CVE-2025-13992MEDIUMSide-channel information leakage in Navigation and Loading in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to bypass site EPSS 0.2%CVE-2026-3929LOWSide-channel information leakage in ResourceTiming in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to leak cross-origin daEPSS 0.2%CVE-2026-18019MEDIUMSide-channel information leakage in Media in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a EPSS 0.2%CVE-2026-8017LOWSide-channel information leakage in Media in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a EPSS 0.1%CVE-2026-6923LOWNuvoton - CWE-1300: Improper Protection of Physical Side ChannelsEPSS 0.1%CVE-2026-0115LOWIn Trusted Execution Environment, there is a possible key leak due to side channel information disclosure. This could lead to physical inforEPSS 0.1%