CPU Side-Channel Information Disclosure Vulnerabilities: May 2018

2018-05-22T01:00:00
ID CISCO-SA-20180521-CPUSIDECHANNEL
Type cisco
Reporter Cisco
Modified 2018-08-31T20:24:48

Description

A vulnerability due to the design of most modern CPUs could allow a local attacker to access sensitive information on a targeted system.

The vulnerability is due to improper implementation of the speculative execution of instructions by the affected software. This vulnerability can be triggered by causing the CPU to attempt to perform a speculative memory read before currently queued memory writes are completed. An attacker could exploit this vulnerability by executing arbitrary code and performing a side-channel attack on the cache of the targeted system. A successful exploit could allow the attacker to read sensitive memory information.

This vulnerability has been assigned the following CVE ID: CVE-2018-3639

A vulnerability due to the design of most modern CPUs could allow a local attacker to access sensitive information on a targeted system.

The vulnerability is due to improper implementation of the speculative execution of instructions by the affected software. This vulnerability can by triggered by causing an affected platform to perform speculative reads of system registers. An attacker could exploit this vulnerability by executing arbitrary code and performing a side-channel attack on the cache of the targeted system. A successful exploit could allow the attacker to read sensitive memory information.

This vulnerability has been assigned the following CVE ID: CVE-2018-3640

On May 21, 2018, researchers disclosed two vulnerabilities that take advantage of the implementation of speculative execution of instructions on many modern microprocessor architectures to perform side-channel information disclosure attacks. These vulnerabilities could allow an unprivileged, local attacker, in specific circumstances, to read privileged memory belonging to other processes.

The first vulnerability, CVE-2018-3639, is known as Spectre Variant 4 or SpectreNG. The second vulnerability, CVE-2018-3640, is known as Spectre Variant 3a. Both of these attacks are variants of the attacks disclosed in January 2018 and leverage cache-timing attacks to infer any disclosed data.

To exploit either of these vulnerabilities, an attacker must be able to run crafted or script code on an affected device. Although the underlying CPU and operating system combination in a product or service may be affected by these vulnerabilities, the majority of Cisco products are closed systems that do not allow customers to run custom code and are, therefore, not vulnerable. There is no vector to exploit them. Cisco products are considered potentially vulnerable only if they allow customers to execute custom code side-by-side with Cisco code on the same microprocessor.

A Cisco product that may be deployed as a virtual machine or a container, even while not directly affected by any of these vulnerabilities, could be targeted by such attacks if the hosting environment is vulnerable. Cisco recommends that customers harden their virtual environments, tightly control user access, and ensure that all security updates are installed. Customers who are deploying products as a virtual device in multi-tenant hosting environments should ensure that the underlying hardware, as well as operating system or hypervisor, is patched against the vulnerabilities in question.

Although Cisco cloud services are not directly affected by these vulnerabilities, the infrastructure on which they run may be impacted. Refer to the “Affected Products” section of this advisory for information about the impact of these vulnerabilities on Cisco cloud services.

Cisco will release software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.

This advisory is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180521-cpusidechannel ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180521-cpusidechannel"]