Side-channel attack in Intel products - CVE-2018-3615

Vulnerability identifier: #VU14410

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-3615

CWE-ID: CWE-200

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to obtain potentially sensitive information.

The vulnerability exists due to an error in systems with microprocessors utilizing speculative execution and Intel® software guard extensions (Intel® SGX). A local attacker can conduct side-channel attack and gain access to potentially sensitive information residing in the L1 data cache from an enclave.

8th Generation Intel Core Processors
7th Generation Intel Core Processors
6th Generation Intel Core Processors
Intel Xeon Processor E3 v6 Family
Intel Xeon Processor E3 v5 Family
Amazon Linux AMI
Slackware Linux
linux-4.4.153/kernel-generic
linux-4.4.153/kernel-huge
linux-4.4.153/kernel-modules
linux-4.4.153/kernel-headers
CloudBoost Virtual Appliance

Install update from vendor's website.

linux-4.4.153/kernel-generic - update to 4.4.153
linux-4.4.153/kernel-huge - update to 4.4.153
linux-4.4.153/kernel-modules - update to 4.4.153
linux-4.4.153/kernel-headers - update to 4.4.153_smp
CloudBoost Virtual Appliance - update to 18.2.0.1

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00161.html

• Information disclosure in Intel CPUs
• Amazon Linux AMI update for kernel
• Multiple vulnerabilities in Dell EMC CloudBoost Virtual Appliance
• Slackware Linux update for kernel