CPU hardware utilizing speculative execution may be vulnerable to cache side-channel attacks

Overview

CPU hardware utilizing speculative execution may be vulnerable to cache timing side-channel analysis. Two vulnerabilities are identified, known as “Variant 3a” and “Variant 4”.

Description

Speculative execution is a technique used by many modern processors to improve performance by predicting which instructions may be executed based on past execution history. An attacker with local user access may be able to utilize sequences of speculative execution to perform a cache timing side-channel analysis.

CWE-208: Information Exposure Through Timing Discrepancy

CVE-2018-3639 – Speculative Store Bypass (SSB) – also known as “Variant 4”

Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may read an earlier value of the data. Subsequent speculative memory accesses cause allocations into the cache, which may allow a sequence of speculative loads to be used to perform timing side-channel attacks. In particular, if an attacker has control of a previously cached value, or the first store and load instructions are accesses onto the stack, an attacker may be able to control future speculative execution and access arbitrary privileged data by using less privileged code with timing side-channel analysis.

CVE-2018-3640 – Rogue System Register Read (RSRE) – also known as “Variant 3a”

Systems with microprocessors utilizing speculative execution and that perform speculative reads of system registers may return a speculative register value that is then used in subsequent speculative load instructions. These subsequence speculative loads cause allocations into the cache that may allow a sequence of speculative loads to be used to perform timing side-channel attacks. An attacker with local user access may be able to use timing side-channel analysis to determine the values stored in system registers.

For more information and technical details, please see the original Project Zero bug report, Intel’s security advisory INTEL-SA-00115, AMD’s whitepaper, and ARM’s whitepaper.

These vulnerabilities have been noted in the media for their similarity to previously-disclosed vulnerabilities: CVE-2017-5753 (Variant 1, “Spectre”), CVE-2017-5715 (Variant 2, “Spectre”), CVE-2017-5754 (Variant 3, “Meltdown”). See VU#584653 for further information.

---

Impact

An attacker with local user access may be able to read arbitrary privileged data or system register values by utilizing cache timing side-channel analysis.

---

Solution

Update system software

Affected users should check with OEM and system software vendors and apply any available updates as soon as possible. Microcode updates and other system updates are expected to be available within the coming weeks. The Vendor Status links below provide further information.

Update your browser

Affected users should update to the latest version of any web browser in use. Most leading browser providers have recently deployed mitigations in their Managed Runtimes – mitigations that substantially increase the difficulty of exploiting side channels in a modern web browser. These techniques would likewise increase the difficulty of exploiting a side channel in a browser based on SSB.

---

Vendor Information

180049

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

AMD __ Affected

Notified: May 04, 2018 Updated: May 23, 2018

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

AMD has released a whitepaper with further details.

Vendor References

• <https://www.amd.com/en/corporate/security-updates&gt;
• <https://developer.amd.com/wp-content/resources/124441_AMD64_SpeculativeStoreBypassDisable_Whitepaper_final.pdf&gt;

Addendum

AMD was reported by researchers as having been affected: <https://bugs.chromium.org/p/project-zero/issues/detail?id=1528&gt;.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23180049 Feedback>).

ARM Limited Affected

Updated: June 14, 2018

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• <https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability&gt;

Apple __ Affected

Notified: May 04, 2018 Updated: June 05, 2018

Statement Date: June 01, 2018

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Please see Apple’s statement for more information.

Vendor References

• <https://support.apple.com//HT208394&gt;

Cisco __ Affected

Notified: May 21, 2018 Updated: May 22, 2018

Statement Date: May 22, 2018

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Please find more information at Cisco Security Advisory 20180521.

Vendor References

• <https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180521-cpusidechannel&gt;

Dell __ Affected

Notified: May 21, 2018 Updated: May 21, 2018

Statement Date: May 21, 2018

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Please see Dell EMC’s statement.

Vendor References

• <http://www.dell.com/support/speculative-store-bypass&gt;

Dell EMC __ Affected

Notified: May 21, 2018 Updated: May 21, 2018

Statement Date: May 21, 2018

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Please see Dell EMC’s statement.

Vendor References

• <http://www.dell.com/support/speculative-store-bypass&gt;

Fortinet, Inc. __ Affected

Notified: May 21, 2018 Updated: May 24, 2018

Statement Date: May 23, 2018

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Please see Fortinet’s advisory FG-IR-18-002 for more information.

Vendor References

• <https://fortiguard.com/psirt/FG-IR-18-002&gt;

HP Inc. __ Affected

Notified: May 21, 2018 Updated: May 24, 2018

Statement Date: May 24, 2018

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

HP has released an advisory with further details.

Vendor References

• <https://support.hp.com/us-en/document/c06001626&gt;

Hitachi __ Affected

Notified: May 21, 2018 Updated: June 05, 2018

Statement Date: June 02, 2018

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Please see more information at HIRT-PUB18001.

Vendor References

• <http://www.hitachi.com/hirt/publications/hirt-pub18001/&gt;

IBM, INC. __ Affected

Notified: May 21, 2018 Updated: May 21, 2018

Statement Date: May 21, 2018

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Please see IBM’s statement for more details.

Vendor References

• <https://www.ibm.com/blogs/psirt/potential-impact-processors-power-family/&gt;

Intel __ Affected

Notified: May 04, 2018 Updated: May 21, 2018

Statement Date: May 21, 2018

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

See Intel security advisory SA-00115 for more details.

Vendor References

• <https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00115.html&gt;

Microsoft __ Affected

Notified: May 04, 2018 Updated: May 21, 2018

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Please see Microsoft security advisories ADV180012 and ADV180013 for more details. Developers may also consult guidance.

Vendor References

• <https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180012&gt;
• <https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV180013&gt;
• <https://docs.microsoft.com/en-us/cpp/security/developer-guidance-speculative-execution&gt;

QUALCOMM Incorporated Affected

Notified: May 21, 2018 Updated: May 21, 2018

Statement Date: May 21, 2018

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Red Hat, Inc. __ Affected

Notified: May 04, 2018 Updated: May 22, 2018

Statement Date: May 22, 2018

Status

Affected

Vendor Statement

Red Hat Product Security is aware of this issue. Updates will be released as they become available. For additional information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/security/vulnerabilities/ssbd

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• <https://access.redhat.com/security/vulnerabilities/ssbd&gt;

SUSE Linux __ Affected

Notified: May 21, 2018 Updated: May 22, 2018

Statement Date: May 22, 2018

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Please see SUSE support document 7022937 for more details.

Vendor References

• <https://www.suse.com/support/kb/doc/?id=7022937&gt;

Synology __ Affected

Notified: May 21, 2018 Updated: May 22, 2018

Statement Date: May 22, 2018

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Please see Synology security advisory SA-18:23 for more information.

Vendor References

• <https://www.synology.com/en-global/support/security/Synology_SA_18_23&gt;

Ubuntu __ Affected

Notified: May 21, 2018 Updated: May 21, 2018

Statement Date: May 22, 2018

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Please see the Ubuntu Security Team KnowledgeBase article for more details.

Vendor References

• <https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Variant4&gt;

VMware __ Affected

Notified: May 04, 2018 Updated: May 21, 2018

Statement Date: May 21, 2018

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Please see VMware Article 54951 for further details.

Vendor References

• <https://kb.vmware.com/s/article/54951&gt;

Amazon __ Not Affected

Notified: May 04, 2018 Updated: May 23, 2018

Statement Date: May 22, 2018

Status

Not Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Please see Amazon’s statement for more details

Vendor References

• <https://aws.amazon.com/security/security-bulletins/AWS-2018-015/&gt;

ASP Linux Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Acer Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

AirWatch Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Alpine Linux Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Android Open Source Project Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Arch Linux Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Arista Networks, Inc. Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

AsusTek Computer Inc. Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Barnes and Noble Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

BlackBerry Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Blunk Microsystems Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

CMX Systems Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

CentOS Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Citrix Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Contiki OS Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

CoreOS Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Cricket Wireless Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Debian GNU/Linux Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Dell SecureWorks Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

DesktopBSD Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

DragonFly BSD Project Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

ENEA Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Express Logic Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

F5 Networks, Inc. Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Fedora Project Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

FreeBSD Project Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Fujitsu Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

GIGABYTE Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Geexbox Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Gentoo Linux Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Google Unknown

Notified: May 04, 2018 Updated: May 04, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

HTC Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

HardenedBSD Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Hewlett Packard Enterprise Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

HomeSeer Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Huawei Technologies Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

IBM Corporation (zseries) Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

IBM Global Services Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

IBM eServer Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Illumos Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Joyent Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Juniper Networks Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Kyocera Communications Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

LG Electronics Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Lenovo Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Linux Kernel Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Lynx Software Technologies Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Micro Focus Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

MontaVista Software, Inc. Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Mozilla Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

NEC Corporation Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

NVIDIA Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

NetBSD Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Nexenta Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Nokia Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

OmniTI Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

OpenBSD Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

OpenIndiana Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Openwall GNU/*/Linux Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Oracle Corporation Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Pantech North America Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

QNX Software Systems Inc. Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Rocket RTOS Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Roku Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Samsung Mobile Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Slackware Linux Inc. Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

SonicWall Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Sony Corporation Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

The Open Group Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Tizen Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Toshiba America Information Systems, Inc. Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Trend Micro Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

TrueOS Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Turbolinux Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Unisys Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Xen Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Xiaomi Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Xilinx Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

Zephyr Project Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

eCosCentric Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

m0n0wall Unknown

Notified: May 21, 2018 Updated: May 21, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

View all 100 vendors __View less vendors __

CVSS Metrics

Group	Score	Vector
Base	4.4	AV:L/AC:M/Au:S/C:C/I:N/A:N
Temporal	3.4	E:POC/RL:OF/RC:C
Environmental	3.4	CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND

References

• <https://vuls.cert.org/confluence/display/Wiki/Vulnerabilities+Associated+with+CPU+Speculative+Execution&gt;
• <https://bugs.chromium.org/p/project-zero/issues/detail?id=1528&gt;
• <https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00115.html&gt;
• <https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability&gt;
• <https://developer.amd.com/wp-content/resources/124441_AMD64_SpeculativeStoreBypassDisable_Whitepaper_final.pdf&gt;
• <https://support.apple.com//HT208394&gt;
• <https://www.kb.cert.org/vuls/id/584653&gt;
• <https://www.us-cert.gov/ncas/alerts/TA18-141A&gt;
• <http://cwe.mitre.org/data/definitions/208.html&gt;
• <https://software.intel.com/sites/default/files/managed/c5/63/336996-Speculative-Execution-Side-Channel-Mitigations.pdf&gt;
• <https://software.intel.com/sites/default/files/managed/b9/f9/336983-Intel-Analysis-of-Speculative-Execution-Side-Channels-White-Paper.pdf&gt;

Acknowledgements

Intel would like to acknowledge and thank Jann Horn of Google Project Zero (GPZ) and Ken Johnson of the Microsoft Security Response Center (MSRC) for independently reporting CVE-2018-3639.Intel would like to acknowledge and thank Zdenek Sojka, Rudolf Marek and Alex Zuepke from SYSGO AG (https://sysgo.com) for reporting CVE-2018-3640. Intel would also like to acknowledge and thank Innokentiy Sennovskiy from BiZone LLC (bi.zone).

This document was written by Garret Wassermann.

Other Information

CVE IDs:	CVE-2018-3639, CVE-2018-3640
Date Public:	2018-05-21 Date First Published: