Am-I-affected-by-Meltdown

私はMeltdownの影響を受けているのか？！ Meltdown CVE-2017-5754 チェッカー これは何？ 概念実証 / エクスプロイト / システムがVariant 3: 不正データキャッシュロード CVE-2017-5754、別名MELTDOWNの影響を受けているかどうかをチェックします。 基本的な考え方は、ユーザーが実行中のシステムに適切なパッチが適用されているかどうかを、 例えばKAISERパッチセット https://lkml.org/lkml/2017/10/31/884 などを用いて知ることができるというものです。 現在はLinuxでのみ動作します 動作の仕組みは...

SpeculativeExecutionAssessment

SpeculativeExecutionAssessment システムが、以下に記載された「投機的実行」の脆弱性に対して評価を行います: CVE-2017-5715 ブランチターゲットインジェクション CVE-2017-5753 境界チェックバイパス CVE-2017-5754 不正データキャッシュロード 警告: ビルドオプションで「Prefer 32-bit」がチェックされていないことを確認してください。 管理者権限が必要です。 緩和策には以下が必要です: 1. アンチウイルス/セキュリティ製品がWindows Updateと互換性があることを示すレジストリ値を設定する 2...

New Ninth-Gen Intel CPUs Shield Against Some Spectre, Meltdown Variants

Intel’s new ninth-generation CPUs come packed with hardware-based protections against two variants of the infamous Meltdown and Spectre speculative execution attacks. The ninth-generation desktop Core processors are dubbed Coffee Lake, and became available for preorder on Tuesday. they’re built t...

Security Bulletin: IBM Netezza Host Management is affected by the vulnerabilities known as Spectre and Meltdown.

Summary IBM Netezza Host Management is affected by the vulnerabilities known as Spectre and Meltdown, which can enable CPU data cache timing to be abused to bypass conventional memory security restrictions to gain access to privileged memory that should be inaccessible. Vulnerability Details CVEI...

KVA Shadow: Mitigating Meltdown on Windows

On January 3rd, 2018, Microsoft released an advisory and security updates that relate to a new class of discovered hardware vulnerabilities, termed speculative execution side channels, that affect the design methodology and implementation decisions behind many modern microprocessors. This post...

New Microsoft Bug Bounty Program Looks To Squash The Next Spectre, Meltdown

In the wake of the Meltdown and Spectre flaws, Microsoft has rolled out a new bug bounty program targeting speculative execution side channel vulnerabilities. The limited time program is open until December 31, and offers up to $250,000 for identifying new categories of speculative execution...

VMware Virtual Appliance updates address side-channel analysis due to speculative execution

a. VMware Virtual Appliance Mitigations for Bounds-Check bypass Spectre-1, and Rogue data cache load issues Meltdown CPU data cache timing can be abused to efficiently leak information out of mis-speculated CPU execution, leading to at worst arbitrary virtual memory read vulnerabilities across...

VMSA-2018-0007:VMware Virtual Appliance updates address side-channel analysis due to speculative execution

VMSA-2018-0007.6 VMware Virtual Appliance updates address side-channel analysis due to speculative execution VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2018-0007.6 VMware Security Advisory Severity: Important VMware Security Advisory Synopsis: VMware Virtual Appliance...

Experts Weigh In On Spectre Patch Challenges

The race to patch against the Meltdown and Spectre processor vulnerabilities disclosed last week is on. As of today, there are no known exploits in the wild impacting vulnerable Intel, AMD and ARM devices. Currently, vendors are focused on three main mitigation efforts. Patches that address the...

Reading privileged memory with a side-channel (Meltdown & Spectre)

We have discovered that CPU data cache timing can be abused to efficiently leak information out of mis-speculated execution, leading to at worst arbitrary virtual memory read vulnerabilities across local security boundaries in various contexts. Variants of this issue are known to affect many mode...