Preface: Hertzbleedis about inferring secrets from timing differencescaused by how CPUs adjust their frequency under load.

Background: The Hertzbleed vulnerability does not specifically target the L2 cache of AMD CPUs. Instead, it exploits a broader mechanism related to dynamic frequency scaling — a feature used by modern CPUs (including AMD Zen 2 and Zen 3) to adjust clock speeds based on workload and thermal conditions.

How is IOLeak Different?

Ref: AMD’s DVFS (Dynamic Voltage and Frequency Scaling) is a power management technique that dynamically adjusts the CPU’s voltage and frequency based on the current workload. This allows for a balance between performance and energy consumption by reducing both when the workload is light and boosting them when more processing power is needed. DVFS is used in AMD processors to optimize power usage and improve battery life in mobile devices, as well as to reduce energy costs in servers.

Vulnerability details: The researchers provided AMD with a summary of their comments and findings, detailed in a paper titled “IOLeak Side-Channel Attacks Exploiting CPU Frequency Scaling and I/O Latency.”

AMD reviewed the summary and believes this attack is similar to previously disclosed side-channel attacks such as “Hertzbleed” and that existing mitigation recommendations for such attacks remain applicable to mitigate the techniques described in the researchers’ summary.

Official announcement: Please see the link for details – https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7042.html

Preface: In the Linux Kernel, SIGFPE (Signal Floating-Point Exception) indicates a computational error, specifically related to floating-point arithmetic or integer arithmetic errors. This signal is triggered by events like floating-point overflow, underflow, or division by zero. While named “Floating-Point Exception,” it actually covers a broader range of arithmetic errors.

Background: What triggers SIGFPE?

• Floating-point errors: These include overflow (exceeding the maximum representable value), underflow (falling below the minimum non-zero value), and division by zero.
• Integer errors: Specifically, integer division by zero can also trigger SIGFPE. 

How it works in the Linux Kernel:

• When a process encounters an arithmetic error that triggers SIGFPE, the kernel sends this signal to the process.
• By default, if a signal handler is not registered for SIGFPE, the process will be terminated.
• If a signal handler is registered, the handler can be used to attempt to recover from the error, such as by retrying the operation or taking alternative actions.
• The si_code field in a signal handler can provide more information about the specific type of arithmetic error that caused SIGFPE. For example, FPE_INTDIV indicates integer division by zero, according to a post on Stack Overflow. 

Vulnerability details: Camm Maguire noticed that on PA-RISC a SIGFPE exception will crash an application with a second SIGFPE in the signal handler.  Dave analyzed it, and it happens because glibc uses a double-word floating-point store to atomically update function descriptors. As a result of lazy binding, it hit a floating-point store in fpe_func almost immediately.

When the T bit is set , an assist exception trap occurs when when the co-processor encounters *any* floating-point instruction except for a double store of register %fr0.  The latter cancels all pending traps. 

Remedy: Linux fix this by clearing the Trap (T) bit in the FP status register before returning to the signal handler in userspace.

Official announcement: For details, please refer to the link –https://nvd.nist.gov/vuln/detail/CVE-2025-37991

Preface: In a typical web application, there are three layers of middleware: Web server middleware. Application server middleware and Database middleware. A common request for file upload applications.

For example: uploading user avatars, attaching documents or handling multimedia content.

Multer is a node.js middleware for handling multipart/form-data, which is primarily used for uploading files.

Background: Express is the most popular Node.js web framework, and is the underlying library for a number of other popular Node.js frameworks.

Multer is a popular middleware for handling file uploads in Node. js applications, especially those built with Express . It makes receiving, validating, and storing files from HTTP requests simple and straightforward.

Vulnerability details: Multer is a node.js middleware for handling `multipart/form-data`. Versions prior to 2.0.0 are vulnerable to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request stream emits an error, the internal `busboy` stream is not closed, violating Node.js stream safety guidance. This leads to unclosed streams accumulating over time, consuming memory and file descriptors. Under sustained or repeated failure conditions, this can result in denial of service, requiring manual server restarts to recover. All users of Multer handling file uploads are potentially impacted. Users should upgrade to 2.0.0 to receive a patch. No known workarounds are available.

Official announcement: For details, please refer to the link –

https://nvd.nist.gov/vuln/detail/CVE-2025-47935

https://nvd.nist.goc/vuln/detail/CVE-2025-47944