Daily Cybersecurity News - February 21, 2026
Firmware Flaw Exposes Secret RSA Keys
MediumExecutive Summary
A side-channel vulnerability, identified as CVE-2021-24119, exists in Trusted Firmware's Mbed TLS. This flaw allows attackers with system-level access to potentially obtain secret RSA keys from isolated software environments. The issue has been resolved in later versions.
Vulnerability Details
- Affected Product: Trusted Firmware Mbed TLS, version 2.24.0 and before.
- Identifier: CVE-2021-24119
- CVSS Score: 4.9 (Medium)
- Exploitation Status: No active exploitation has been publicly reported.
Risk & Impact
- Triage: Medium; requires immediate patching for systems utilizing affected versions in secure environments like Intel SGX.
- Attack Vector: An attacker with administrator-level privileges can exploit this by observing physical system characteristics like power consumption or timing during the decoding of base64 PEM files to infer information about secret RSA keys.
- Ease of Exploit: High complexity. The attack requires significant control over the target environment and the ability to perform detailed side-channel analysis.
Action Plan
- Immediate Action: Upgrade Mbed TLS to a patched version, such as 2.26.0, 2.27.0 or newer, which contain fixes for this vulnerability.
- Workaround: In the absence of a patch, limit system-level access and monitor for unusual activity, although this is not a complete mitigation.
- Detection: Detection is difficult as the attack is passive and non-invasive. Focus on preventing the vulnerability by applying updates rather than detecting active exploitation.
Relevant professional terms
- Side-channel vulnerability
- A security exploit that gathers information by observing the physical effects of a system's operation, such as power consumption, timing variations, or electromagnetic emissions, rather than by targeting software flaws directly.
- Intel SGX (Software Guard Extensions)
- A set of security-related instruction codes built into modern Intel CPUs that allow user-level code to allocate private regions of memory, called enclaves. These enclaves are protected from processes running at higher privilege levels, including the operating system and hypervisor.
Kernel Flaw Causes Critical Boot Failures
Executive Summary
A vulnerability identified as CVE-2025-71114 has been resolved in the Linux kernel. This critical flaw in the VIA watchdog timer driver could cause a system to hang during the boot process due to an error in how a resource was named and allocated.
Vulnerability Details
- Affected Product: Linux Kernel (on systems with VIA chipsets using the via_wdt driver)
- Identifier: CVE-2025-71114
- CVSS Score: Not yet available
- Exploitation Status: No known active exploitation.
Risk & Impact
- Triage: Urgent. Applying updates is recommended to prevent potential denial-of-service conditions.
- Attack Vector: The vulnerability is local and occurs during the system's boot sequence. An unnamed MMIO resource reservation causes failures in the kernel's resource management, leading to a complete system hang.
- Ease of Exploit: Low. The flaw requires specific hardware (VIA chipsets) and the associated driver to be in use for the system to be vulnerable.
Action Plan
- Immediate Action: Apply the latest kernel updates provided by your Linux distribution.
- Workaround: If patching is not immediately possible, the `via_wdt` kernel module can be blacklisted to prevent it from loading, which mitigates the issue on affected systems.
- Detection: Monitor for system boot failures or hangs during initialization, particularly on hardware utilizing VIA chipsets. Check /proc/iomem for entries marked with the string "BAD".
Relevant professional terms
- Watchdog Timer (WDT)
- A hardware timer that is used to automatically detect and recover from computer malfunctions. If the main program fails to reset the watchdog timer periodically, the timer will elapse and cause a system reset.
- Resource Allocation
- The process of assigning available system resources, such as memory-mapped I/O (MMIO) regions, to hardware devices or software processes. Improper allocation or naming can lead to conflicts and system instability.
Libcoap Flaw Enables Remote Attacks
CriticalExecutive Summary
A critical stack-based buffer overflow vulnerability, identified as CVE-2025-34468, has been disclosed in the libcoap library. This flaw can be triggered by a remote attacker using specially crafted hostname data, leading to a denial of service or potential remote code execution.
Vulnerability Details
- Affected Product: libcoap versions up to and including 4.3.5.
- Identifier: CVE-2025-34468
- CVSS Score: 9.8 (Critical) via NVD / 8.2 (High) via VulnCheck..
- Exploitation Status: Unspecified. Details not publicly disclosed.
Risk & Impact
- Triage: Critical. Immediate patching is recommended due to the potential for remote code execution.
- Attack Vector: A remote attacker can send malicious hostname data to an application using the libcoap proxy functionality. The application copies the data into a fixed-size stack buffer without proper bounds checking, triggering the overflow.
- Ease of Exploit: Exploitation requires the proxy logic to be enabled in the target application. While this is a specific configuration, a successful exploit could lead to a system crash (DoS) or allow an attacker to run arbitrary code.
Action Plan
- Immediate Action: Upgrade to a patched version of libcoap. The fix was introduced in commit 30db3ea.
- Workaround: If patching is not immediately possible, consider disabling the proxy logic in applications that use libcoap to mitigate the attack vector.
- Detection: Monitor network traffic for unusually long hostname resolution requests directed at services using the libcoap library.
Relevant professional terms
- Stack-Based Buffer Overflow
- A security vulnerability that occurs when a program writes more data to a buffer located on the call stack than is allocated for that buffer. This can corrupt adjacent data, cause a crash, or be exploited to execute arbitrary code.
- Remote Code Execution (RCE)
- A critical vulnerability that allows a remote attacker to execute malicious commands or code on a target system over a network. A successful RCE attack can lead to complete system compromise, data theft, or further network infiltration.
Redis Flaw Enables Remote Code Execution
HighExecutive Summary
A high-severity vulnerability, identified as CVE-2024-31449, has been discovered in Redis. The flaw allows an authenticated attacker to trigger a stack buffer overflow using a specially crafted Lua script, which could lead to remote code execution. This vulnerability has been patched by the vendor.
Vulnerability Details
- Affected Product: All versions of Redis with Lua scripting functionality are affected.
- Identifier: CVE-2024-31449
- CVSS Score: 8.8 (High)
- Exploitation Status: Public proof-of-concept is available.
Risk & Impact
- Triage: Immediate patching is required due to the high severity and potential for remote code execution.
- Attack Vector: An authenticated attacker can exploit this vulnerability by sending a specially crafted Lua script to the Redis server. The flaw exists in the Lua bit library, where improper handling of certain values in the `bit.tohex` function leads to a stack buffer overflow.
- Ease of Exploit: An attacker requires authentication to the Redis instance, but the exploit itself does not require user interaction.
Action Plan
- Immediate Action: Upgrade to a patched version of Redis: 6.2.16, 7.2.6, or 7.4.1.
- Workaround: There are no known workarounds; upgrading is the only effective mitigation. Best practices include restricting network access to trusted sources and enforcing strong authentication.
- Detection: Monitor for unexplained Redis server crashes (especially with stack traces from the Lua engine), anomalous command execution, and unexpected network traffic from the Redis database.
Relevant professional terms
- Remote Code Execution (RCE)
- A type of vulnerability that allows a malicious actor to execute arbitrary commands or code on a remote target machine across a network, potentially leading to full system compromise.
- Stack Buffer Overflow
- A security vulnerability that occurs when a program writes more data to a buffer on the call stack than the buffer is intended to hold. This can overwrite adjacent memory, leading to program crashes, data corruption, or the execution of malicious code.