CVE-2024-2193

2024-03-1500:00:00

ubuntu.com

speculative race condition

vulnerability

modern cpu

architecture

spectre v1

unauthenticated attacker

race conditions

speculative execution

bug

hypervisor

ipi storming

linux kernel

synchronization primitives

unix

6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.5%

JSON

A Speculative Race Condition (SRC) vulnerability that impacts modern CPU
architectures supporting speculative execution (related to Spectre V1) has
been disclosed. An unauthenticated attacker can exploit this vulnerability
to disclose arbitrary data from the CPU using race conditions to access the
speculative executable code paths.

Bugs

Notes

Author	Note
mdeslaur	hypervisor packages are in universe. For issues in the hypervisor, add appropriate tags to each section, ex: Tags_xen: universe-binary
rodrigo-zaiden	IPI Storming, aka CVE-2024-26602, can be used to win a SRC. as per the ghostrace post in vusec: a generic SRC mitigation is to serialize all the affected synchronization primitives. and the answer is: The Linux kernel developers have no immediate plans to implement our proposed serialization of synchronization primitives due to performance concerns.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchlinux< anyUNKNOWN
ubuntu20.04noarchlinux< anyUNKNOWN
ubuntu22.04noarchlinux< anyUNKNOWN
ubuntu23.10noarchlinux< anyUNKNOWN
ubuntu24.04noarchlinux< anyUNKNOWN
ubuntu14.04noarchlinux< anyUNKNOWN
ubuntu16.04noarchlinux< anyUNKNOWN
ubuntu18.04noarchlinux-aws< anyUNKNOWN
ubuntu20.04noarchlinux-aws< anyUNKNOWN
ubuntu22.04noarchlinux-aws< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	linux	< any	UNKNOWN
ubuntu	20.04	noarch	linux	< any	UNKNOWN
ubuntu	22.04	noarch	linux	< any	UNKNOWN
ubuntu	23.10	noarch	linux	< any	UNKNOWN
ubuntu	24.04	noarch	linux	< any	UNKNOWN
ubuntu	14.04	noarch	linux	< any	UNKNOWN
ubuntu	16.04	noarch	linux	< any	UNKNOWN
ubuntu	18.04	noarch	linux-aws	< any	UNKNOWN
ubuntu	20.04	noarch	linux-aws	< any	UNKNOWN
ubuntu	22.04	noarch	linux-aws	< any	UNKNOWN