Most recent entries from all

bdu:2018-00001

Withdrawn: BELL-CVE-2017-5754 — CVE-2017-5754 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2018-ale-001 — \[Mise à jour du 25/05/2018 : ajout de bulletins Microsoft (cf. section Documentation)\] \[Mi…

certfr-2018-ale-001

certfr-2018-avi-004 — De multiples vulnérabilités ont été découvertes dans le noyau Linux de RedHat . Elles permettent à un attaquant de prov…
certfr-2018-avi-004

cisco-sa-20180104-cpusidechannel — CPU Side-Channel Information Disclosure Vulnerabilities

On January 3, 2018, researchers disclosed three vulnerabilities that take advantage of the implementation of speculative execution of instructions on many modern microprocessor architectures to perform side-channel information disclosure attacks. These vulnerabilities could allow an unprivileged local attacker, in specific circumstances, to read privileged memory belonging to other processes or memory allocated to the operating system kernel. The first two vulnerabilities, CVE-2017-5753 and CVE-2017-5715, are collectively known as Spectre. The third vulnerability, CVE-2017-5754, is known as Meltdown. The vulnerabilities are all variants of the same attack and differ in the way that speculative execution is exploited. To exploit any of these vulnerabilities, an attacker must be able to run crafted code on an affected device. Although the underlying CPU and operating system combination in a product or service may be affected by these vulnerabilities, the majority of Cisco products are closed systems that do not allow customers to run custom code and are, therefore, not vulnerable. There is no vector to exploit them. Cisco products are considered potentially vulnerable only if they allow customers to execute custom code side-by-side with Cisco code on the same microprocessor. A Cisco product that may be deployed as a virtual machine or a container, even while not directly affected by any of these vulnerabilities, could be targeted by such attacks if the hosting envir…

cnvd-2018-00303
cnvd-2018-00303

EUVD-2026-322539
EUVD-2026-322539

fkie_cve-2017-5754

Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.

gsd-2017-5754
gsd-2017-5754

openSUSE-SU-2024:10728-1 — kernel-devel-5.14.6-1.4 on GA media

kernel-devel-5.14.6-1.4 on GA media

RHSA-2018:0010 — Red Hat Security Advisory: kernel security update

hw: cpu: speculative execution bounds-check bypass hw: cpu: speculative execution permission faults handling

SUSE-SU-2018:0010-1 — Security update for the Linux Kernel

Security update for the Linux Kernel

UBUNTU-CVE-2017-5754

Affected: Ubuntu:14.04:LTS: firefox, Ubuntu:14.04:LTS: linux, Ubuntu:14.04:LTS: linux-aws, Ubuntu:14.04:LTS: linux-lts-xenial, Ubuntu:16.04:LTS: firefox, Ubuntu:16.04:LTS: linux, Ubuntu:16.04:LTS: linux-aws, Ubuntu:16.04:LTS: linux-azure, Ubuntu:16.04:LTS: linux-euclid, Ubuntu:16.04:LTS: linux-gcp and 15 more

Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.

VDE-2018-002 — Pepperl+Fuchs: HMI devices vulnerable to Meltdown and Spectre Attacks

Critical vulnerabilities within several CPUs have been identified by security researchers. These hardware vulnerabilities allow programs to learn about the contents of a system's memory, using side-channel attacks. Potential attack vectors against these vulnerabilities have been published and dubbed Meltdown and Spectre. While programs are typically not permitted to read data from the OS kernel or from other programs, a malicious program can exploit Meltdown and Spectre to get hold of secrets stored in kernel memory or the memory of other programs executed on the same CPU. As a consequence, an exploit could allow attackers to get access to any sensitive data, including passwords or cryptographic keys.

VDE-2018-003 — PHOENIX CONTACT: addressing Meltdown and Spectre vulnerabilities

Several CPUs manufactured by Intel, AMD or based on ARM technology may leak information due to their internal operation if attacked by specifically written software executed on the affected systems.

The information in this advisory is based on the statements of respective manufacturers.

WID-SEC-W-2023-0103 — Meltdown und Spectre: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in den meisten der aktuellen Prozessoren ausnutzen, um Sicherheitsmechanismen zu umgehen und physikalischen Speicher auszulesen.