Reptar (vulnerability)

Intel CPU vulnerability discovered in late 2023

ReptarCVE identifier(s)| CVE-2023-23583

|

Date discovered| 2023
Affected hardware| Alder Lake, Raptor Lake, Sapphire Rapids

Reptar is a CPU vulnerability discovered in late 2023, affecting a number of recent families of Intel x86 CPUs. According to The Register, the following CPU families are vulnerable: Alder Lake, Raptor Lake and Sapphire Rapids.[1]

The Reptar vulnerability relates to processing of x86 instruction prefixes in ways that lead to unexpected behavior. It was discovered by Google's security team.[2][3] The vulnerability can be exploited in a number of ways, potentially leading to information leakage, denial of service, or privilege escalation.[4][5]

It has been assigned the CVE ID CVE-2023-23583.[5] Intel have released new microcode in an out-of-band patch to mitigate the vulnerability, which it calls "redundant prefix".[1][6]

## References

[edit]

1. ^ a b Claburn, Thomas. "Intel out-of-band patch addresses privilege escalation flaw". www.theregister.com. Retrieved 2023-12-14.
2. ^ "Reptar: a vulnerability in Intel processors". www.kaspersky.co.uk. 2023-11-27. Retrieved 2023-12-14.
3. ^ "Google researchers discover 'Reptar,' a new CPU vulnerability". Google Cloud Blog. November 15, 2023. Retrieved 2023-12-14.
4. ^ Kovacs, Eduard (November 15, 2023). "New Intel CPU Vulnerability 'Reptar' Can Allow DoS Attacks, Privilege Escalation". Security Week. Retrieved 2023-12-14.
5. ^ a b "CVE - CVE-2023-23583". cve.mitre.org. Retrieved 2023-12-14.
6. ^ "INTEL-SA-00950: 2023.4 IPU Out-of-Band (OOB) - Intel® Processor Advisory". Intel. 2023-11-14. Retrieved 2023-12-14.

## External links

[edit]

* Analysis of Reptar by Google researcher Tavis Ormandy

* v
* t
* e

Hacking in the 2020s

| <- 2010s | Timeline | 2030s ->

|
|

Major incidents|

| 2020|

* BlueLeaks
* Twitter account hijacking
* European Medicines Agency data breach
* Nintendo data leak
* United States federal government data breach
* EasyJet data breach
* Vastaamo data breach

|

2021|

* Microsoft Exchange Server breach
* Ivanti Pulse Connect Secure data breach
* Colonial Pipeline ransomware attack
* Health Service Executive ransomware attack
* Waikato District Health Board ransomware attack
* JBS S.A. ransomware attack
* Kaseya VSA ransomware attack
* Transnet ransomware attack
* Epik data breach
* FBI email hack
* National Rifle Association ransomware attack
* Banco de Oro hack

2022|

* Ukraine cyberattacks
* Red Cross data breach
* Anonymous and the Russian invasion of Ukraine
* Viasat hack
* DDoS attacks on Romania
* Costa Rican ransomware attack
* LastPass vault theft
* Shanghai police database leak
* Grand Theft Auto VI content leak

2023|

* Munster Technological University ransomware attack
* Evide data breach
* MOVEit data breach
* Insomniac Games data breach
* Polish railway cyberattack
* British Library cyberattack

2024|

* XZ Utils backdoor
* Kadokawa and Niconico
* Change Healthcare ransomware attack
* Ukrainian cyberattacks against Russia
* 2024 WazirX hack
* Trump campaign hack
* Fur Affinity domain hijacking
* IRLeaks attack on Iranian banks
* Internet Archive data breach

Groups|

* Anonymous
* associated events
* Anonymous Sudan
* Berserk Bear
* BlackCat
* Clop
* Cozy Bear
* DarkMatter
* DarkSide
* Dridex
* Ghostwriter
* GnosticPlayers
* Guacamaya
* Hafnium
* IT Army of Ukraine
* Killnet
* Lapsus$
* LightBasin
* LockBit
* OceanLotus
* REvil
* Sandworm
* Sakura Samurai
* ShinyHunters
* SiegedSec
* Wizard Spider

Individuals|

* Graham Ivan Clark
* maia arson crimew
* IntelBroker
* Kirtaner

Major vulnerabilities
publicly disclosed|

* SMBGhost (2020)
* Thunderspy (2020)
* PrintNightmare (2021)
* FORCEDENTRY (2021)
* Log4Shell (2021)
* Account pre-hijacking (2022)
* Retbleed (2022)
* Downfall (2023)
* LogoFAIL (2023)
* Reptar (2023)
* Terrapin (2023)
* GoFetch (2024)
* Sinkclose (2024)

Malware|

| 2020|

* Adrozek
* Drovorub

|

2021|

* Predator

2022|

* Cyclops Blink
* Pipedream

This computing article is a stub. You can help Wikipedia by expanding it.

|

* v
* t
* e

*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template