Executive Summary
Summary | |
---|---|
Title | CPU Side-Channel Information Disclosure Vulnerabilities: August 2018 |
Informations | |||
---|---|---|---|
Name | cisco-sa-20180814-cpusidechannel | First vendor Publication | 2018-08-14 |
Vendor | Cisco | Last vendor Modification | 2018-08-14 |
Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:L/AC:M/Au:N/C:C/I:P/A:N) | |||
---|---|---|---|
Cvss Base Score | 5.4 | Attack Range | Local |
Cvss Impact Score | 7.8 | Attack Complexity | Medium |
Cvss Expoit Score | 3.4 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
On August 14th, 2018, three vulnerabilities were disclosed by Intel and security researchers that leverage a speculative execution side-channel method referred to as L1 Terminal Fault (L1TF) that affects modern Intel microprocessors. These vulnerabilities could allow an unprivileged, local attacker, in specific circumstances, to read privileged memory belonging to other processes. The first vulnerability, CVE-2018-3615, affects Intel SGX technology and is referred to by the researchers who discovered it as foreshadow. This vulnerability is not known to affect any Cisco devices as the Cisco devices do not utilize Intel SGX technology. Cisco Unified Computing System servers do support the usage of Intel SGX technology but may be provisioned by a customer in their environment to use Intel SGX technology. The second vulnerability, CVE-2018-3620, and the third vulnerability, CVE-2018-3646, are referred to as L1 Terminal Fault attacks by Intel. These two vulnerabilities affect multi-core processors that leverage Intel Hyper-Threading technology supporting Operating System, System Management Mode, and Virtualized workloads. Like the previously disclosed Spectre vulnerabilities, all three new vulnerabilities leverage cache-timing attacks to infer any disclosed data. To exploit any of these vulnerabilities, an attacker must be able to run crafted or script code on an affected device. Although the underlying CPU and operating system combination in a product or service may be affected by these vulnerabilities, the majority of Cisco products are closed systems that do not allow customers to run custom code and are, therefore, not vulnerable. There is no vector from which to exploit them. Cisco products are considered potentially vulnerable only if they allow customers to execute custom code side-by-side with Cisco code on the same microprocessor. A Cisco product that may be deployed as a virtual machine or a container, even while not directly affected by any of these vulnerabilities, could be targeted by such attacks if the hosting environment is vulnerable. Cisco recommends that customers harden their virtual environments, tightly control user access, and ensure that all security updates are installed. Customers who are deploying products as a virtual device in multi-tenant hosting environments should ensure that the underlying hardware, as well as the operating system or hypervisor, is patched against the vulnerabilities in question. Although Cisco cloud services are not directly affected by these vulnerabilities, the infrastructure on which they run may be impacted. See the Affected Products ["#ap"] section of this advisory for information about the impact of these vulnerabilities on Cisco cloud services. Cisco will release software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. This advisory is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180814-cpusidechannel ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180814-cpusidechannel"] BEGIN PGP SIGNATURE iQJ5BAEBAgBjBQJbcyDfXBxDaXNjbyBQcm9kdWN0IFNlY3VyaXR5IEluY2lkZW50 IFJlc3BvbnNlIFRlYW0gKENpc2NvIFBTSVJUIGtleSAyMDE4LTIwMTkpIDxwc2ly dEBjaXNjby5jb20+AAoJEJa12PPJBfczJ3gQAJomL0QxgA3+wjXI4Nfm1Z3bTEgy QN6uuroB7nessBKliCH10FkgcRvjXq7DZEprl/IoRYwt1HLD5i7n5q8UEJPdLxmx h2mlqGvhC38jxy3g39HFMAgvC3rr1FXvpkmR/J4sfnqbPNaxZMTmLYZIF5GzDhSb L6DpvXOruXSIzr3JL6NYFP7q5p4gRB7EAb2nSXZ0YdQOHK3alNik2MpzO890njdb 18JxjS+KgcLpcOBN9bxGdiQjR0b3hzQ5+t1MfBINeaqmqEDgM2Q+HaUtzVHclNuT x1NzPtrzMa2S5XMQyY2/xFnb1OjmNSCFZXZ/4Jsey7kGQOyghbvHImqiF83ZJUoT wwk0yFfZqG5nC3apEATNPkr+fWXc4jEGlpixxlCP0lz9YdmvGXV75jt2pDhPbnE1 dlOxV3goH0e081sDPal2UfAxL7KjA8Np7+L+utm75MOep4QPaHb0KVCq+nfE6XBe P16Svk/8VYKdqyNMmvZJBv4+veaMq5MObFdEbxmSFRWFZOK6idEJa7bStpb2PEmm Zvlok45w0o6oC4qaDN0mbet+oiIdUVerhSkh9yPSyH5BY1r8sLJGfg41VSjk3WcL APec1ufh9huKefH8eOvGEfp+kxgwOEhYOzg6yfVrSJ2xRlX19qnEW4VA2RgXvgzR nLN320UMc7kKFNHR =8gDf END PGP SIGNATURE _______________________________________________ cust-security-announce mailing list cust-security-announce@cisco.com To unsubscribe, send the command "unsubscribe" in the subject of your message to cust-security-announce-leave@cisco.com |
Original Source
Url : http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco (...) |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-203 | Information Exposure Through Discrepancy |
CPE : Common Platform Enumeration
Snort® IPS/IDS
Date | Description |
---|---|
2020-12-05 | Intel x86 L1 data cache side-channel analysis information leak attempt RuleID : 47598 - Revision : 1 - Type : OS-OTHER |
2020-12-05 | Intel x86 L1 data cache side-channel analysis information leak attempt RuleID : 47597 - Revision : 1 - Type : OS-OTHER |
2020-12-05 | Intel x86 L1 data cache side-channel analysis information leak attempt RuleID : 47596 - Revision : 1 - Type : OS-OTHER |
2020-12-05 | Intel x86 L1 data cache side-channel analysis information leak attempt RuleID : 47595 - Revision : 1 - Type : OS-OTHER |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2019-01-10 | Name : The remote device is affected by multiple vulnerabilities. File : juniper_space_jsa10917_184R1.nasl - Type : ACT_GATHER_INFO |
2019-01-03 | Name : The remote Fedora host is missing one or more security updates. File : fedora_2018-f8cba144ae.nasl - Type : ACT_GATHER_INFO |
2019-01-03 | Name : The remote Fedora host is missing a security update. File : fedora_2018-683dfde81a.nasl - Type : ACT_GATHER_INFO |
2018-10-31 | Name : The remote host is missing a macOS security update that fixes multiple vulner... File : macosx_SecUpd_10_13_6_2018-002.nasl - Type : ACT_GATHER_INFO |
2018-10-31 | Name : The remote host is missing a macOS or Mac OS X security update that fixes mul... File : macosx_SecUpd2018-005.nasl - Type : ACT_GATHER_INFO |
2018-10-31 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201810-06.nasl - Type : ACT_GATHER_INFO |
2018-10-26 | Name : The remote EulerOS Virtualization host is missing a security update. File : EulerOS_SA-2018-1350.nasl - Type : ACT_GATHER_INFO |
2018-10-26 | Name : The remote EulerOS Virtualization host is missing multiple security updates. File : EulerOS_SA-2018-1345.nasl - Type : ACT_GATHER_INFO |
2018-10-26 | Name : The remote EulerOS Virtualization host is missing multiple security updates. File : EulerOS_SA-2018-1323.nasl - Type : ACT_GATHER_INFO |
2018-10-18 | Name : The remote host is missing a macOS update that fixes multiple security vulner... File : macos_10_14.nasl - Type : ACT_GATHER_INFO |
2018-09-17 | Name : The remote Debian host is missing a security update. File : debian_DLA-1506.nasl - Type : ACT_GATHER_INFO |
2018-09-04 | Name : The remote Fedora host is missing a security update. File : fedora_2018-915602df63.nasl - Type : ACT_GATHER_INFO |
2018-09-04 | Name : The remote EulerOS host is missing multiple security updates. File : EulerOS_SA-2018-1279.nasl - Type : ACT_GATHER_INFO |
2018-09-04 | Name : The remote EulerOS host is missing multiple security updates. File : EulerOS_SA-2018-1278.nasl - Type : ACT_GATHER_INFO |
2018-08-31 | Name : The remote Virtuozzo host is missing multiple security updates. File : Virtuozzo_VZA-2018-063.nasl - Type : ACT_GATHER_INFO |
2018-08-31 | Name : The remote PhotonOS host is missing multiple security updates. File : PhotonOS_PHSA-2018-2_0-0088.nasl - Type : ACT_GATHER_INFO |
2018-08-31 | Name : The remote PhotonOS host is missing multiple security updates. File : PhotonOS_PHSA-2018-1_0-0180.nasl - Type : ACT_GATHER_INFO |
2018-08-29 | Name : The remote Debian host is missing a security update. File : debian_DLA-1481.nasl - Type : ACT_GATHER_INFO |
2018-08-29 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2018-240-01.nasl - Type : ACT_GATHER_INFO |
2018-08-23 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_2310b814a65211e8805ba4badb2f4699.nasl - Type : ACT_GATHER_INFO |
2018-08-20 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-4279.nasl - Type : ACT_GATHER_INFO |
2018-08-20 | Name : The remote Virtuozzo host is missing multiple security updates. File : Virtuozzo_VZA-2018-055.nasl - Type : ACT_GATHER_INFO |
2018-08-17 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-4274.nasl - Type : ACT_GATHER_INFO |
2018-08-16 | Name : A server virtualization platform installed on the remote host is affected by ... File : citrix_xenserver_CTX236548.nasl - Type : ACT_GATHER_INFO |
2018-08-16 | Name : The remote Fedora host is missing one or more security updates. File : fedora_2018-1c80fea1cd.nasl - Type : ACT_GATHER_INFO |
2018-08-15 | Name : The remote Amazon Linux 2 host is missing a security update. File : al2_ALAS-2018-1058.nasl - Type : ACT_GATHER_INFO |
2018-08-15 | Name : A virtualization application installed on the remote macOS or Mac OS X host i... File : macosx_fusion_vmsa_2018_0020.nasl - Type : ACT_GATHER_INFO |
2018-08-15 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2018-2390.nasl - Type : ACT_GATHER_INFO |
2018-08-15 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2018-2384.nasl - Type : ACT_GATHER_INFO |
2018-08-15 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2018-1058.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2018-08-17 21:22:18 |
|
2018-08-17 00:20:52 |
|
2018-08-15 00:21:46 |
|
2018-08-15 00:19:02 |
|