{"id":62206,"date":"2023-01-04T16:59:57","date_gmt":"2023-01-05T00:59:57","guid":{"rendered":"https:\/\/www.rambus.com\/?page_id=62206"},"modified":"2026-01-27T20:53:39","modified_gmt":"2026-01-28T04:53:39","slug":"report-vulnerability","status":"publish","type":"page","link":"https:\/\/www.rambus.com\/security\/response-center\/report-vulnerability\/","title":{"rendered":"Reporting a potential security vulnerability"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Home<\/a><\/span><\/span><\/p>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"Security\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Security<\/span><\/h3>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Reporting a potential security vulnerability<\/h1>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Product Security Incidence Response Team (PSIRT)<\/h2>\n

Rambus has built a Product Security Incident Response Team (PSIRT), which is responsible for responding to Rambus security incidences. PSIRT manages receipt, investigation and releasing of information about security issues regarding Rambus products. PSIRT is the single point of contact between the security reporter and vendor. The Rambus PSIRT adheres to ISO\/IEC 29147:2018.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\tReport Vulnerability<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\"ContactContact<\/a>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Procedure overview<\/h2>

In order to have a clear and consistent approach to managing security issues, Rambus has defined a procedure for managing security issues. The procedure includes the following steps:<\/p>

1. Receipt and Acknowledgement<\/strong>
Rambus has a dedicated issue reporting channel that can be used by independent researchers, labs, hackers to report potential vulnerabilities. See section Contact for details of contacting Rambus regarding security issues. Our PSIRT team monitor the email reporting channel for new reports. After receiving a report, we will contact you within 7 calendar days acknowledging receipt.<\/p>

2. Verification<\/strong>
After receiving the potential vulnerability, we will initiate a verification process to establish if the potential vulnerability is applicable or not.<\/p>

If the potential vulnerability is considered not to be a vulnerability, Rambus will inform the security reporter and other relevant stakeholders.<\/p>

If it is considered to be a vulnerability, Rambus will perform root cause analysis. Vulnerabilities will be prioritized and categorized. We will keep the security reporter updated throughout the process.<\/p>

3. Remediation Development<\/strong>
In this phase, Rambus develops solutions for remediating the security vulnerability. When needed, we work with our customers to find the best solution and provide support for implementing the remediation. All remediation will be tested before release to ensure the vulnerability has been resolved and does not introduce new vulnerabilities.<\/p>

4. Release of Advisory, Remediation and Credit<\/strong>
Customers will be notified of the issue and will receive an update or patch as soon as it is available. An advisory may be released following customer notification, the timing of which may be aligned with the security reporter. Rambus may credit the security reporter, with his\/her permission, following responsible vulnerability disclosure guidelines.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

How to Report a Vulnerability<\/h2>

If you have identified a potential security issue regarding a Rambus product, it is strongly encouraged that you contact the Rambus Product Security Incident Response Team (PSIRT), by sending an email to PSIRT@rambus.com<\/a>.<\/p>

Encryption Using the Rambus PGP Public Key<\/span>
To ensure confidentiality, we recommend that you encrypt your findings using PGP. Download the Rambus PSIRT PGP public key<\/a> and use it to encrypt details of the vulnerability and any relevant issues. Attach the encrypted file to the email and send to psirt@rambus.com<\/a>.<\/p>

Vulnerability information is sensitive information and is strongly encouraged that your report is encrypted.\u00a0<\/p>

You may obtain the software to encrypt messages from:<\/p>