Speculative Execution Side Channel Variants 4 and 3a - US

Lenovo Security Advisory: LEN-22133

**Potential Impact:**Malicious code running locally may be able to observe contents of privileged memory or registers, circumventing expected privilege levels

Severity: Medium

Scope of Impact: Industry-wide

CVE Identifier: CVE-2018-3639, CVE-2018-3640

Summary Description:

Lenovo is aware of vulnerabilities affecting certain Intel, AMD, and other processors named “Variant 4 – Speculative Store Bypass” and “Variant 3a – Rogue System Register Read” by their discoverers. Both are “side channel” vulnerabilities, meaning they do not access protected data directly, but rather induce the processor to operate in a specific way, and observe execution timing or other externally visible characteristics to infer the protected data.

Mitigation Strategy for Customers (what you should do to protect yourself):

There are two new vulnerability variants, which are in the same family as the side channel attacks disclosed in January (Variant 1 CVE-2017-5753, Variant 2 CVE-2017-5715, and Variant 3 CVE-2017-5754). Processor manufacturers such as Intel are making BIOS microcode updates available to address Variant 4 and 3a. We recommend updating browser, OS, and BIOS as soon as these mitigations are available:

Variant 4: Speculative Store Bypass (CVE-2018-3639)

• Update BIOS
• Update operating system
• Update applications

Variant 3a: Rogue Register Load (CVE-2018-3640)

• Update BIOS

We will update this page frequently as fixes are validated or new information emerges. Please check back often.

Prior to patching and firmware update, you can limit your risk by following the usual security best practices to prevent an attacker from running code locally on your system. For example: Limit access to only known and trusted users; install only well-vetted, trusted applications; visit only reputable web sites with minimal obtrusive advertising and content pulled-in from other sources; and if feasible, turn off JavaScript in your browser.

Product Impact: