Vulnerability Note VU#584653

CPU hardware vulnerable to side-channel attacks

Original Release date: 03 Jan 2018 | Last revised: 03 Jan 2018

Overview

CPU hardware implementations are vulnerable to side-channel attacks. These vulnerabilities are referred to as Meltdown and Spectre.

Description

CPU hardware implementations are vulnerable to side-channel attacks referred to as Meltdown and Spectre (also KAISER and KPTI). These attacks are described in detail by Google Project Zero and the Institute of Applied Information Processing and Communications (IAIK) at Graz University of Technology (TU Graz).

Impact

An attacker able to execute code with user privileges can achieve various impacts, such as reading otherwise protected kernel memory and bypassing KASLR.

Solution

Replace CPU hardware

The underlying vulnerability is primarily caused by CPU architecture design choices. Fully removing the vulnerability requires replacing vulnerable CPU hardware.

Apply updates

Operating system updates mitigate the underlying hardware vulnerability.

Vendor Information (Learn More)

Many CPU architectures are affected. The list below consists of CPU vendors and operating system vendors.

VendorStatusDate NotifiedDate Updated
AMDAffected-03 Jan 2018
ArmAffected-03 Jan 2018
GoogleAffected-03 Jan 2018
IntelAffected-03 Jan 2018
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base 1.5 AV:L/AC:M/Au:S/C:P/I:N/A:N
Temporal 1.2 E:POC/RL:OF/RC:C
Environmental 2.0 CDP:ND/TD:H/CR:H/IR:ND/AR:ND

References

Credit

These issues were researched and reported by researchers at Google Project Zero and the Institute of Applied Information Processing and Communications (IAIK) at Graz University of Technology (TU Graz).

This document was written by Art Manion.

Other Information

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.