OpenSUSE Linux update for xen



Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2018-3646
CWE-ID CWE-200
Exploitation vector Local network
Public exploit N/A
Vulnerable software
 Opensuse
Operating systems & Components / Operating system

Vendor SUSE

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Side-channel attack

EUVDB-ID: #VU14412

Risk: Low

CVSSv4.0: 4.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-3646

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

Exploit availability: No

Description

The vulnerability allows an adjacent attacker to obtain potentially sensitive information.

The vulnerability exists due to an error in systems with microprocessors utilizing speculative execution and address translations. An adjacent attacker with guest OS privilege can trigger terminal page fault, conduct side-channel attack and gain access to potentially sensitive information residing in the L1 data cache.

Mitigation

Update the affected packages.

Vulnerable software versions

Opensuse: 42.3

CPE2.3 External links

https://lists.opensuse.org/opensuse-security-announce/2018-08/msg00067.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###