Fallos del tipo CWE-1300

35 resultados

Vazamento de informação por canal lateral

Ocorre quando a implementação de uma função criptográfica ou autenticação vazaza informações sensíveis através de observáveis indiretos como tempo de execução, consumo de energia, radiação eletromagnética ou padrões de acesso à memória. Um atacante consegue inferir dados secretos (chaves, senhas, tokens) sem quebrar a criptografia em si, apenas medindo esses efeitos colaterais.

Ejemplo

Uma função de comparação de senha que faz loop byte a byte e sai cedo quando encontra o primeiro byte diferente: um atacante pode medir o tempo de resposta e deduzir qual é o prefixo correto da senha, testando caractere por caractere. Outro caso clássico: uma multiplicação modular em RSA que leva tempo proporcional ao número de bits 1 na chave privada.

Cómo mitigar

Use funções de comparação constante (timing-safe) para dados sensíveis. Implemente operações criptográficas com tempo de execução fixo, sem branches ou loops dependentes de dados secretos. Considere usar bibliotecas auditadas (libsodium, OpenSSL com proteções) ao invés de implementações próprias.

CVE-2023-6258HIGHPkcs11-provider: side-channel proofing pkcs#1 1.5 pathsEPSS 0.6%CVE-2026-13922MEDIUMSide-channel information leakage in Paint in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a EPSS 0.3%CVE-2026-13790MEDIUMSide-channel information leakage in Scroll in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via aEPSS 0.3%CVE-2026-13935MEDIUMSide-channel information leakage in ComputePressure in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin dEPSS 0.3%CVE-2026-17800MEDIUMInappropriate implementation in MediaRecording in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensiEPSS 0.3%CVE-2026-17796MEDIUMSide-channel information leakage in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive EPSS 0.3%CVE-2025-10890CRITICALSide-channel information leakage in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to leak cross-origin data via a crEPSS 0.3%CVE-2026-14074MEDIUMSide-channel information leakage in WebAuthentication in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to leak crossEPSS 0.3%CVE-2026-17696MEDIUMSide-channel information leakage in Media in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a EPSS 0.3%CVE-2026-13809MEDIUMSide-channel information leakage in Safe Browsing in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who had compromisEPSS 0.3%CVE-2026-11153CRITICALSide-channel information leakage in Forms in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a EPSS 0.3%CVE-2026-17859MEDIUMInappropriate implementation in Favicons in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a cEPSS 0.3%CVE-2026-17851MEDIUMSide-channel information leakage in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rendeEPSS 0.3%CVE-2026-14085MEDIUMSide-channel information leakage in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crEPSS 0.3%CVE-2025-11207MEDIUMSide-channel information leakage in Storage in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to perform arbitrary read/writEPSS 0.2%CVE-2026-5876MEDIUMSide-channel information leakage in Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to leak cross-origin data vEPSS 0.2%CVE-2026-17730MEDIUMSide-channel information leakage in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engagEPSS 0.2%CVE-2026-17760MEDIUMSide-channel information leakage in NoStatePrefetch in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin dEPSS 0.2%CVE-2026-14071MEDIUMSide-channel information leakage in WebAudio in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data viaEPSS 0.2%CVE-2026-11284MEDIUMSide-channel information leakage in PerformanceAPIs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin dEPSS 0.2%