CVE-2017-5754
published 2018-01-04CVE-2017-5754: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker…
PriorityP350medium5.6CVSS 3.1
AVLACHPRLUINSCCHINAN
EPSS
84.17%
99.7th percentile
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.
Affected
916 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios | — | — |
| apple | macos_high_sierra_10.13.2_security_update_2017-002_sierra_and_security_update_20 | — | — |
| apple | macos_high_sierra_10.13.3_security_update_2018-001_sierra_and_security_update_20 | — | — |
| apple | tvos | — | — |
| apple | watchos | — | — |
| arm | cortex-a | — | — |
| citrix | xenserver | — | — |
| citrix | xenserver | — | — |
| citrix | xenserver | — | — |
| citrix | xenserver | — | — |
| debian | debian_linux | — | — |
| debian | linux | < linux 4.14.12-1 (bookworm) | linux 4.14.12-1 (bookworm) |
| debian | nvidia-graphics-drivers | < linux 4.14.12-1 (bookworm) | linux 4.14.12-1 (bookworm) |
| debian | nvidia-graphics-drivers-legacy-340xx | < linux 4.14.12-1 (bookworm) | linux 4.14.12-1 (bookworm) |
| debian | xen | < xen 4.8.3+xsa262+shim4.10.0+comet3-1+deb9u6 (bookworm) | xen 4.8.3+xsa262+shim4.10.0+comet3-1+deb9u6 (bookworm) |
| debian | xen | < xen 4.11.1-1 (bookworm) | xen 4.11.1-1 (bookworm) |
| debian | xen | < linux 4.14.12-1 (bookworm) | linux 4.14.12-1 (bookworm) |
| android | — | — | |
| intel | atom_c | — | — |
| intel | atom_c | — | — |
| intel | atom_c | — | — |
| intel | atom_c | — | — |
| intel | atom_c | — | — |
| intel | atom_c | — | — |
| intel | atom_c | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →CVE-2017-5754 exploits speculative execution at the hardware level, not a software flaw — detection should focus on microarchitectural side-channel behaviour rather than software artifacts ↗
- →Use authenticated vulnerability scans or endpoint agents to identify systems missing Meltdown/Spectre patches; over 75 QIDs exist to determine patch state ↗
- ·Intel firmware updates for Broadwell and Haswell CPUs were pulled due to causing unexpected reboots and potential data loss/corruption — deploying those microcode versions may destabilise systems ↗
- ·Virtual scanner appliances can still be indirectly affected by CVE-2017-5754 if the vulnerability is exploitable at the hypervisor level; the underlying hypervisor must be patched separately ↗
CVSS provenance
nvdv3.15.6MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
nvdv3.05.6MEDIUMCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
nvdv2.04.7MEDIUMAV:L/AC:M/Au:N/C:C/I:N/A:N
osv7.8HIGH
vendor_ubuntu7.8HIGH
vendor_cisco5.6MEDIUM
vendor_debian5.6MEDIUM
vendor_redhat5.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
xen: x86: DoS from attempting to use INVPCID with a non-canonical addresses
vendor_redhat·2018-11-20·CVSS 5.6
CVE-2018-19965 [MEDIUM] CWE-228 xen: x86: DoS from attempting to use INVPCID with a non-canonical addresses
xen: x86: DoS from attempting to use INVPCID with a non-canonical addresses
An issue was discovered in Xen through 4.11.x allowing 64-bit PV guest OS users to cause a denial of service (host OS crash) because #GP[0] can occur after a non-canonical address is passed to the TLB flushing code. NOTE: this issue exists because of an incorrect CVE-2017-5754 (aka Meltdown) mitigation.
Package: kernel-xen (Red Hat Enterprise Linux 5) - Not affected
Android
CVE-2017-5754: Kernel Memory
vendor_android·2018-09-01·CVSS 5.6
CVE-2017-5754 [MEDIUM] CVE-2017-5754: Kernel Memory
Android Security Bulletin 2018-09-01
CVE: CVE-2017-5754
Severity: HIGH
Type: ID
Component: Kernel Memory
References: A-69856074*
Upstream kernel
Red Hat
xen: x86 PV guest may crash Xen with XPTI
vendor_redhat·2018-04-25·CVSS 5.6
CVE-2018-10471 [MEDIUM] CWE-787 xen: x86 PV guest may crash Xen with XPTI
xen: x86 PV guest may crash Xen with XPTI
An issue was discovered in Xen through 4.10.x allowing x86 PV guest OS users to cause a denial of service (out-of-bounds zero write and hypervisor crash) via unexpected INT 80 processing, because of an incorrect fix for CVE-2017-5754.
An OOB write issue was found in the way Xen hypervisor handled error in the Page Table Isolation (PTI) implementation, used to fix the Meltdown issue. It could occur while processing interrupt 'INT 0x80', when PV guest's vCPU has no handler for it. A malicious guest user/process could use this flaw to crash the hypervisor resulting in denial of service issue.
Package: xen (Red Hat Enterprise Linux 5) - Not affected
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2018-03-15·CVSS 5.6
CVE-2017-5715 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
USNS 3541-1 and 3523-1 provided mitigations for Spectre and Meltdown
(CVE-2017-5715, CVE-2017-5753, CVE-2017-5754) for the i386, amd64,
and ppc64el architectures in Ubuntu 17.10. This update provides
the corresponding mitigations for the arm64 architecture. Original
advisory details:
Jann Horn discovered that microprocessors utilizing speculative execution
and indirect branch prediction may allow unauthorized memory reads via
sidechannel attacks. This flaw is known as Meltdown. A local attacker could
use this to expose sensitive information, including kernel memory.
(CVE-2017-5754)
Jann Horn discovered that microprocessors utilizing speculative execution
and branch prediction may allow
Ubuntu
Linux kernel (HWE) vulnerabilities
vendor_ubuntu·2018-03-15·CVSS 5.6
CVE-2017-5715 [MEDIUM] Linux kernel (HWE) vulnerabilities
Title: Linux kernel (HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
USN-3597-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.10.
This update provides the corresponding updates for the Linux Hardware
Enablement (HWE) kernel from Ubuntu 17.10 for Ubuntu 16.04 LTS.
USNS 3541-2 and 3523-2 provided mitigations for Spectre and Meltdown
(CVE-2017-5715, CVE-2017-5753, CVE-2017-5754) for the i386, amd64,
and ppc64el architectures for Ubuntu 16.04 LTS. This update provides
the corresponding mitigations for the arm64 architecture. Original
advisory details:
Jann Horn discovered that microprocessors utilizing speculative execution
and indirect branch prediction may allow unauthorized memory reads via
sidechannel attacks. This flaw is known as Meltdo
BSD
FreeBSD-SA-18:03.speculative_execution: Speculative Execution Vulnerabilities
bsd_advisories·2018-03-14·CVSS 5.6
CVE-2017-5715 [MEDIUM] FreeBSD-SA-18:03.speculative_execution: Speculative Execution Vulnerabilities
FreeBSD-SA-18:03.speculative_execution Security Advisory
The FreeBSD Project
Topic: Speculative Execution Vulnerabilities
Category: core
Module: kernel
Announced: 2018-03-14
Credits: Jann Horn (Google Project Zero); Werner Haas, Thomas
Prescher (Cyberus Technology); Daniel Gruss, Moritz Lipp,
Stefan Mangard, Michael Schwarz (Graz University of
Technology); Paul Kocher; Daniel Genkin (University of
Pennsylvania and University of Maryland), Mike Hamburg
(Rambus); Yuval Yarom (University of Adelaide and Data6)
Affects: All supported versions of FreeBSD.
Corrected: 2018-02-17 18:00:01 UTC (stable/11, 11.1-STABLE)
2018-03-14 04:00:00 UTC (releng/11.1, 11.1-RELEASE-p8)
CVE Name: CVE-2017-5715, CVE-2017-5754
Special Note: Speculative execution vulnerability mitigation is a work
in progress. Th
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2018-02-23·CVSS 7.8
CVE-2017-0750 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that an out-of-bounds write vulnerability existed in the
Flash-Friendly File System (f2fs) in the Linux kernel. An attacker could
construct a malicious file system that, when mounted, could cause a denial
of service (system crash) or possibly execute arbitrary code.
(CVE-2017-0750)
It was discovered that a race condition leading to a use-after-free
vulnerability existed in the ALSA PCM subsystem of the Linux kernel. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2017-0861)
It was discovered that the KVM implementation in the Linux kernel allowed
passthrough of the diagnostic I/O port 0x80. An attacke
Apple
CVE-2017-5754: macOS High Sierra 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan
vendor_apple·2018-01-23·CVSS 5.6
CVE-2017-5754 [MEDIUM] CVE-2017-5754: macOS High Sierra 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan
Apple Security Update: About the security content of macOS High Sierra 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan
Product: macOS High Sierra 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan
CVE: CVE-2017-5754
Component: Kernel
Impact: An application may be able to read kernel memory (Meltdown)
Description: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.
Ubuntu
Linux kernel (Xenial HWE) vulnerabilities
vendor_ubuntu·2018-01-23·CVSS 5.6
CVE-2017-5715 [MEDIUM] Linux kernel (Xenial HWE) vulnerabilities
Title: Linux kernel (Xenial HWE) vulnerabilities
Summary: Several security issues were addressed in the Linux kernel.
USN-3540-1 addressed vulnerabilities in the Linux kernel for Ubuntu
16.04 LTS. This update provides the corresponding updates for the
Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for
Ubuntu 14.04 LTS.
Jann Horn discovered that microprocessors utilizing speculative
execution and branch prediction may allow unauthorized memory
reads via sidechannel attacks. This flaw is known as Spectre. A
local attacker could use this to expose sensitive information,
including kernel memory. This update provides mitigations for the
i386 (CVE-2017-5753 only), amd64, ppc64el, and s390x architectures.
(CVE-2017-5715, CVE-2017-5753)
USN-3522-2 mitigated CVE-2017-5754 (Meltdow
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2018-01-23·CVSS 5.6
CVE-2017-5715 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were addressed in the Linux kernel.
Jann Horn discovered that microprocessors utilizing speculative
execution and branch prediction may allow unauthorized memory
reads via sidechannel attacks. This flaw is known as Spectre. A
local attacker could use this to expose sensitive information,
including kernel memory. This update provides mitigations for the
i386 (CVE-2017-5753 only), amd64, ppc64el, and s390x architectures.
(CVE-2017-5715, CVE-2017-5753)
USN-3523-1 mitigated CVE-2017-5754 (Meltdown) for the amd64
architecture in Ubuntu 17.10. This update provides the corresponding
mitigations for the ppc64el architecture. Original advisory details:
Jann Horn discovered that microprocessors utilizing speculative
execution a
Ubuntu
Linux kernel (HWE) vulnerabilities
vendor_ubuntu·2018-01-23·CVSS 5.6
CVE-2017-5715 [MEDIUM] Linux kernel (HWE) vulnerabilities
Title: Linux kernel (HWE) vulnerabilities
Summary: Several security issues were addressed in the Linux kernel.
USN-3541-1 addressed vulnerabilities in the Linux kernel for Ubuntu
17.10. This update provides the corresponding updates for the
Linux Hardware Enablement (HWE) kernel from Ubuntu 17.10 for Ubuntu
16.04 LTS.
Jann Horn discovered that microprocessors utilizing speculative
execution and branch prediction may allow unauthorized memory
reads via sidechannel attacks. This flaw is known as Spectre. A
local attacker could use this to expose sensitive information,
including kernel memory. This update provides mitigations for the
i386 (CVE-2017-5753 only), amd64, ppc64el, and s390x architectures.
(CVE-2017-5715, CVE-2017-5753)
USN-3523-2 mitigated CVE-2017-5754 (Meltdown) for the amd6
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2018-01-23·CVSS 5.6
CVE-2017-5715 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were addressed in the Linux kernel.
Jann Horn discovered that microprocessors utilizing speculative
execution and branch prediction may allow unauthorized memory
reads via sidechannel attacks. This flaw is known as Spectre. A
local attacker could use this to expose sensitive information,
including kernel memory. This update provides mitigations for the
i386 (CVE-2017-5753 only), amd64, ppc64el, and s390x architectures.
(CVE-2017-5715, CVE-2017-5753)
USN-3522-1 mitigated CVE-2017-5754 (Meltdown) for the amd64
architecture in Ubuntu 16.04 LTS. This update provides the
corresponding mitigations for the ppc64el architecture. Original
advisory details:
Jann Horn discovered that microprocessors utilizing speculative
executi
Ubuntu
Linux kernel vulnerability
vendor_ubuntu·2018-01-10
CVE-2017-5754 Linux kernel vulnerability
Title: Linux kernel vulnerability
Summary: The system could be made to expose sensitive information.
Jann Horn discovered that microprocessors utilizing speculative execution
and indirect branch prediction may allow unauthorized memory reads via
sidechannel attacks. This flaw is known as Meltdown. A local attacker could
use this to expose sensitive information, including kernel memory.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linu
Ubuntu
Linux kernel regression
vendor_ubuntu·2018-01-10·CVSS 5.6
CVE-2017-5754 [MEDIUM] Linux kernel regression
Title: Linux kernel regression
Summary: USN-3522-1 introduced a regression in the Linux kernel.
USN-3522-1 fixed a vulnerability in the Linux kernel to address
Meltdown (CVE-2017-5754). Unfortunately, that update introduced
a regression where a few systems failed to boot successfully. This
update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Jann Horn discovered that microprocessors utilizing speculative execution
and indirect branch prediction may allow unauthorized memory reads via
sidechannel attacks. This flaw is known as Meltdown. A local attacker could
use this to expose sensitive information, including kernel memory.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: D
Ubuntu
Linux kernel (Trusty HWE) vulnerability
vendor_ubuntu·2018-01-10
CVE-2017-5754 Linux kernel (Trusty HWE) vulnerability
Title: Linux kernel (Trusty HWE) vulnerability
Summary: The system could be made to expose sensitive information.
USN-3524-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 14.04 LTS for Ubuntu
12.04 ESM.
Jann Horn discovered that microprocessors utilizing speculative execution
and indirect branch prediction may allow unauthorized memory reads via
sidechannel attacks. This flaw is known as Meltdown. A local attacker could
use this to expose sensitive information, including kernel memory.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
Ubuntu
Linux kernel (HWE) vulnerabilities
vendor_ubuntu·2018-01-10·CVSS 7.8
CVE-2017-16995 [HIGH] Linux kernel (HWE) vulnerabilities
Title: Linux kernel (HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
USN-3523-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.10.
This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 17.10 for Ubuntu
16.04 LTS.
Jann Horn discovered that microprocessors utilizing speculative execution
and indirect branch prediction may allow unauthorized memory reads via
sidechannel attacks. This flaw is known as Meltdown. A local attacker could
use this to expose sensitive information, including kernel memory.
(CVE-2017-5754)
Jann Horn discovered that the Berkeley Packet Filter (BPF) implementation
in the Linux kernel did not properly check the relationship between pointer
values and the BPF stack. A lo
Ubuntu
Linux kernel (Xenial HWE) regression
vendor_ubuntu·2018-01-10·CVSS 5.6
CVE-2017-5754 [MEDIUM] Linux kernel (Xenial HWE) regression
Title: Linux kernel (Xenial HWE) regression
Summary: USN-3522-2 introduced a regression in the Linux Hardware Enablement kernel.
USN-3522-2 fixed a vulnerability in the Linux Hardware Enablement
kernel for Ubuntu 14.04 LTS to address Meltdown (CVE-2017-5754).
Unfortunately, that update introduced a regression where a few systems
failed to boot successfully. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Jann Horn discovered that microprocessors utilizing speculative execution
and indirect branch prediction may allow unauthorized memory reads via
sidechannel attacks. This flaw is known as Meltdown. A local attacker could
use this to expose sensitive information, including kernel memory.
Instructions: After a standard system update you nee
Ubuntu
Linux kernel vulnerability
vendor_ubuntu·2018-01-09
CVE-2017-5754 Linux kernel vulnerability
Title: Linux kernel vulnerability
Summary: Several security issues were fixed in the Linux kernel.
Jann Horn discovered that microprocessors utilizing speculative execution
and indirect branch prediction may allow unauthorized memory reads via
sidechannel attacks. This flaw is known as Meltdown. A local attacker could
use this to expose sensitive information, including kernel memory.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-
Ubuntu
Linux (Xenial HWE) vulnerability
vendor_ubuntu·2018-01-09·CVSS 5.6
CVE-2017-5754 [MEDIUM] Linux (Xenial HWE) vulnerability
Title: Linux (Xenial HWE) vulnerability
Summary: Several security issues were fixed in the Linux kernel.
USN-3522-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 LTS.
Jann Horn discovered that microprocessors utilizing speculative execution
and indirect branch prediction may allow unauthorized memory reads via
sidechannel attacks. This flaw is known as Meltdown. A local attacker could
use this to expose sensitive information, including kernel memory.
(CVE-2017-5754)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updat
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2018-01-09·CVSS 7.8
CVE-2017-16995 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Jann Horn discovered that microprocessors utilizing speculative execution
and indirect branch prediction may allow unauthorized memory reads via
sidechannel attacks. This flaw is known as Meltdown. A local attacker could
use this to expose sensitive information, including kernel memory.
(CVE-2017-5754)
Jann Horn discovered that the Berkeley Packet Filter (BPF) implementation
in the Linux kernel did not properly check the relationship between pointer
values and the BPF stack. A local attacker could use this to cause a denial
of service (system crash) or possibly execute arbitrary code.
(CVE-2017-17863)
Jann Horn discovered that the Berkeley Packet Filter (BPF) implementation
in the Linux
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2018-01-05·CVSS 5.6
CVE-2017-5715 [MEDIUM] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Firefox could be made to expose sensitive information.
It was discovered that speculative execution performed by modern CPUs
could leak information through a timing side-channel attack, and that
this could be exploited in web browser JavaScript engines. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit this to obtain sensitive information from other
domains, bypassing same-origin restrictions. (CVE-2017-5715,
CVE-2017-5753, CVE-2017-5754).
Instructions: After a standard system update you need to restart Firefox to make
all the necessary changes.
Palo Alto
PAN-SA-2018-0001 Information about Meltdown and Spectre findings
vendor_paloalto·2018-01-05·CVSS 5.6
CVE-2017-5715 [MEDIUM] CWE-200 PAN-SA-2018-0001 Information about Meltdown and Spectre findings
PAN-SA-2018-0001 Information about Meltdown and Spectre findings
Palo Alto Networks is aware of recent vulnerability disclosures, known as Meltdown and Spectre, that affect modern CPU architectures. At this time, our findings show that these vulnerabilities pose no increased risk to Palo Alto Networks PAN-OS devices. (CVE-2017-5715, CVE-2017-5753, and CVE-2017-5754). This security advisory will be updated as more information becomes available or if there are changes in the impact of these vulnerabilities. PAN-OS/Panorama platforms are not directly impacted by these vulnerabilities, as successful
CVEs: CVE-2017-5715, CVE-2017-5753, CVE-2017-5754
Affected products: PAN-OS, Panorama
Cisco
CPU Side-Channel Information Disclosure Vulnerabilities
vendor_cisco·2018-01-05·CVSS 5.6
CVE-2017-5715 [MEDIUM] CWE-200 CPU Side-Channel Information Disclosure Vulnerabilities
CPU Side-Channel Information Disclosure Vulnerabilities
On January 3, 2018, researchers disclosed three vulnerabilities that take advantage of the implementation of speculative execution of instructions on many modern microprocessor architectures to perform side-channel information disclosure attacks. These vulnerabilities could allow an unprivileged local attacker, in specific circumstances, to read privileged memory belonging to other processes or memory allocated to the operating system kernel.
The first two vulnerabilities, CVE-2017-5753 and CVE-2017-5715, are collectively known as Spectre. The third vulnerability, CVE-2017-5754, is known as Meltdown. The vulnerabilities are all variants of the same attack and differ in the way that speculative execution is exploited.
To exploit any
Red Hat
hw: cpu: speculative execution permission faults handling
vendor_redhat·2018-01-03·CVSS 5.6
CVE-2017-5754 [MEDIUM] CWE-226 hw: cpu: speculative execution permission faults handling
hw: cpu: speculative execution permission faults handling
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.
An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimization). There are three primary variants of the issue which differ in the way the speculative execution can be exploited. Variant CVE-2017-5754 relies on the fact that, on impacted microprocessors, during speculative execution of instruction permission faults, exception generation triggered by a faulting access is suppressed until the retirem
Debian
CVE-2018-10471: xen - An issue was discovered in Xen through 4.10.x allowing x86 PV guest OS users to ...
vendor_debian·2018·CVSS 5.6
CVE-2018-10471 [MEDIUM] CVE-2018-10471: xen - An issue was discovered in Xen through 4.10.x allowing x86 PV guest OS users to ...
An issue was discovered in Xen through 4.10.x allowing x86 PV guest OS users to cause a denial of service (out-of-bounds zero write and hypervisor crash) via unexpected INT 80 processing, because of an incorrect fix for CVE-2017-5754.
Scope: local
bookworm: resolved (fixed in 4.8.3+xsa262+shim4.10.0+comet3-1+deb9u6)
bullseye: resolved (fixed in 4.8.3+xsa262+shim4.10.0+comet3-1+deb9u6)
forky: resolved (fixed in 4.8.3+xsa262+shim4.10.0+comet3-1+deb9u6)
sid: resolved (fixed in 4.8.3+xsa262+shim4.10.0+comet3-1+deb9u6)
trixie: resolved (fixed in 4.8.3+xsa262+shim4.10.0+comet3-1+deb9u6)
Debian
CVE-2018-19965: xen - An issue was discovered in Xen through 4.11.x allowing 64-bit PV guest OS users ...
vendor_debian·2018·CVSS 5.6
CVE-2018-19965 [MEDIUM] CVE-2018-19965: xen - An issue was discovered in Xen through 4.11.x allowing 64-bit PV guest OS users ...
An issue was discovered in Xen through 4.11.x allowing 64-bit PV guest OS users to cause a denial of service (host OS crash) because #GP[0] can occur after a non-canonical address is passed to the TLB flushing code. NOTE: this issue exists because of an incorrect CVE-2017-5754 (aka Meltdown) mitigation.
Scope: local
bookworm: resolved (fixed in 4.11.1-1)
bullseye: resolved (fixed in 4.11.1-1)
forky: resolved (fixed in 4.11.1-1)
sid: resolved (fixed in 4.11.1-1)
trixie: resolved (fixed in 4.11.1-1)
Apple
CVE-2017-5754: macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and Security Update 2017-005 El Capitan
vendor_apple·2017-12-06·CVSS 5.6
CVE-2017-5754 [MEDIUM] CVE-2017-5754: macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and Security Update 2017-005 El Capitan
Apple Security Update: About the security content of macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and Security Update 2017-005 El Capitan
Product: macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and Security Update 2017-005 El Capitan
CVE: CVE-2017-5754
Component: Kernel
Impact: An application may be able to read kernel memory (Meltdown)
Description: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.
Apple
CVE-2017-5754: watchOS 4.2
vendor_apple·2017-12-05·CVSS 5.6
CVE-2017-5754 [MEDIUM] CVE-2017-5754: watchOS 4.2
Apple Security Update: About the security content of watchOS 4.2
Product: watchOS
Version: 4.2
CVE: CVE-2017-5754
Component: Kernel
Impact: An application may be able to read kernel memory (Meltdown)
Description: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.
Apple
CVE-2017-5754: tvOS 11.2
vendor_apple·2017-12-04·CVSS 5.6
CVE-2017-5754 [MEDIUM] CVE-2017-5754: tvOS 11.2
Apple Security Update: About the security content of tvOS 11.2
Product: tvOS
Version: 11.2
CVE: CVE-2017-5754
Component: Kernel
Impact: An application may be able to read kernel memory (Meltdown)
Description: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.
Apple
CVE-2017-5754: iOS 11.2
vendor_apple·2017-12-02·CVSS 5.6
CVE-2017-5754 [MEDIUM] CVE-2017-5754: iOS 11.2
Apple Security Update: About the security content of iOS 11.2
Product: iOS
Version: 11.2
CVE: CVE-2017-5754
Component: Kernel
Impact: An application may be able to read kernel memory (Meltdown)
Description: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.
Debian
CVE-2017-5754: linux - Systems with microprocessors utilizing speculative execution and indirect branch...
vendor_debian·2017·CVSS 5.6
CVE-2017-5754 [MEDIUM] CVE-2017-5754: linux - Systems with microprocessors utilizing speculative execution and indirect branch...
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.
Scope: local
bookworm: resolved (fixed in 4.14.12-1)
bullseye: resolved (fixed in 4.14.12-1)
forky: resolved (fixed in 4.14.12-1)
sid: resolved (fixed in 4.14.12-1)
trixie: resolved (fixed in 4.14.12-1)
Cisco
CPU Side-Channel Information Disclosure Vulnerabilities
vendor_cisco
CVE-2017-5715 CPU Side-Channel Information Disclosure Vulnerabilities
CVE-2017-5715: CPU Side-Channel Information Disclosure Vulnerabilities
On January 3, 2018, researchers disclosed three vulnerabilities that take advantage of the implementation of speculative execution of instructions on many modern microprocessor architectures to perform side-channel information disclosure attacks. These vulnerabilities could allow an unprivileged local attacker, in specific circumstances, to read privileged memory belonging to other processes or memory allocated to the operating system kernel. The first two vulnerabilities, CVE-2017-5753 and CVE-2017-5715, are collectively known as Spectre . The third vulnerability, CVE-2017-5754, is known as Meltdown . The vulnerabilities are all variants of the same attack and differ in the way that speculative execution is exploited.
Cisco
CPU Side-Channel Information Disclosure Vulnerabilities
vendor_cisco
CVE-2017-5753 CPU Side-Channel Information Disclosure Vulnerabilities
CVE-2017-5753: CPU Side-Channel Information Disclosure Vulnerabilities
On January 3, 2018, researchers disclosed three vulnerabilities that take advantage of the implementation of speculative execution of instructions on many modern microprocessor architectures to perform side-channel information disclosure attacks. These vulnerabilities could allow an unprivileged local attacker, in specific circumstances, to read privileged memory belonging to other processes or memory allocated to the operating system kernel. The first two vulnerabilities, CVE-2017-5753 and CVE-2017-5715, are collectively known as Spectre . The third vulnerability, CVE-2017-5754, is known as Meltdown . The vulnerabilities are all variants of the same attack and differ in the way that speculative execution is exploited.
Cisco
CPU Side-Channel Information Disclosure Vulnerabilities
vendor_cisco
CVE-2017-5754 CPU Side-Channel Information Disclosure Vulnerabilities
CVE-2017-5754: CPU Side-Channel Information Disclosure Vulnerabilities
On January 3, 2018, researchers disclosed three vulnerabilities that take advantage of the implementation of speculative execution of instructions on many modern microprocessor architectures to perform side-channel information disclosure attacks. These vulnerabilities could allow an unprivileged local attacker, in specific circumstances, to read privileged memory belonging to other processes or memory allocated to the operating system kernel. The first two vulnerabilities, CVE-2017-5753 and CVE-2017-5715, are collectively known as Spectre . The third vulnerability, CVE-2017-5754, is known as Meltdown . The vulnerabilities are all variants of the same attack and differ in the way that speculative execution is exploited.
GHSA
XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown (CVE-2017-5754, one aspect of XSA-254).
ghsa_unreviewed·2026-10-13·CVSS 5.6
CVE-2026-79609 [MEDIUM] XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown (CVE-2017-5754, one aspect of XSA-254).
XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown
(CVE-2017-5754, one aspect of XSA-254). This involves copying 64-bit PV
guest page table entries from guest-chosen root page tables to the Xen-
chosen one which is in actual use by hardware. To read the guest root
page table, the directmap is used. PV guests, however, have a directmap
which may not cover all memory; in particular this is the case if any
memory extends beyond the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) address
boundary.
VulDB
Oracle Communications LSMS 13.1/13.2/13.3 Kernel information disclosure (VU#584653 / Nessus ID 209571)
vuldb·2026-05-29·CVSS 5.6
CVE-2017-5754 [MEDIUM] Oracle Communications LSMS 13.1/13.2/13.3 Kernel information disclosure (VU#584653 / Nessus ID 209571)
A vulnerability labeled as critical has been found in Oracle Communications LSMS 13.1/13.2/13.3. The impacted element is an unknown function of the component Kernel. Such manipulation leads to information disclosure.
This vulnerability is traded as CVE-2017-5754. An attack has to be approached locally. There is no exploit available.
The affected component should be upgraded.
VulDB
CPU on Intel/AMD/ARM Speculative Execution Meltdown information disclosure (RHSA-2018:0292 / VU#584653)
vuldb·2026-05-29·CVSS 5.6
CVE-2017-5754 [MEDIUM] CPU on Intel/AMD/ARM Speculative Execution Meltdown information disclosure (RHSA-2018:0292 / VU#584653)
A vulnerability labeled as critical has been found in CPU on Intel/AMD/ARM. This issue affects some unknown processing of the component Speculative Execution. The manipulation results in information disclosure (Meltdown).
This vulnerability is cataloged as CVE-2017-5754. The attack may be launched remotely. Furthermore, there is an exploit available.
It is advisable to implement a patch to correct this issue.
VulDB
Apple macOS up to 10.13.3 Kernel Meltdown information disclosure (HT208465 / VU#584653)
vuldb·2026-05-29·CVSS 5.6
CVE-2017-5754 [MEDIUM] Apple macOS up to 10.13.3 Kernel Meltdown information disclosure (HT208465 / VU#584653)
A vulnerability, which was classified as critical, was found in Apple macOS up to 10.13.3. This affects an unknown part of the component Kernel. Executing a manipulation can lead to information disclosure (Meltdown).
This vulnerability is handled as CVE-2017-5754. The attack can be executed remotely. There is not any exploit available.
Applying a patch is advised to resolve this issue.
GHSA
GHSA-v5vc-f4vf-8rvg: An issue was discovered in Xen through 4
ghsa_unreviewed·2022-05-14·CVSS 5.6
CVE-2018-10471 [MEDIUM] CWE-787 GHSA-v5vc-f4vf-8rvg: An issue was discovered in Xen through 4
An issue was discovered in Xen through 4.10.x allowing x86 PV guest OS users to cause a denial of service (out-of-bounds zero write and hypervisor crash) via unexpected INT 80 processing, because of an incorrect fix for CVE-2017-5754.
GHSA
GHSA-c3g2-qp55-6gjf: An issue was discovered in Xen through 4
ghsa_unreviewed·2022-05-13·CVSS 5.6
CVE-2018-19965 [MEDIUM] GHSA-c3g2-qp55-6gjf: An issue was discovered in Xen through 4
An issue was discovered in Xen through 4.11.x allowing 64-bit PV guest OS users to cause a denial of service (host OS crash) because #GP[0] can occur after a non-canonical address is passed to the TLB flushing code. NOTE: this issue exists because of an incorrect CVE-2017-5754 (aka Meltdown) mitigation.
OSV
CVE-2018-19965: An issue was discovered in Xen through 4
osv·2018-12-08·CVSS 5.6
CVE-2018-19965 [MEDIUM] CVE-2018-19965: An issue was discovered in Xen through 4
An issue was discovered in Xen through 4.11.x allowing 64-bit PV guest OS users to cause a denial of service (host OS crash) because #GP[0] can occur after a non-canonical address is passed to the TLB flushing code. NOTE: this issue exists because of an incorrect CVE-2017-5754 (aka Meltdown) mitigation.
OSV
CVE-2018-10471: An issue was discovered in Xen through 4
osv·2018-04-27·CVSS 5.6
CVE-2018-10471 [MEDIUM] CVE-2018-10471: An issue was discovered in Xen through 4
An issue was discovered in Xen through 4.10.x allowing x86 PV guest OS users to cause a denial of service (out-of-bounds zero write and hypervisor crash) via unexpected INT 80 processing, because of an incorrect fix for CVE-2017-5754.
OSV
linux-hwe vulnerabilities
osv·2018-03-15·CVSS 5.6
CVE-2017-5715 [MEDIUM] linux-hwe vulnerabilities
linux-hwe vulnerabilities
USN-3597-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.10.
This update provides the corresponding updates for the Linux Hardware
Enablement (HWE) kernel from Ubuntu 17.10 for Ubuntu 16.04 LTS.
USNS 3541-2 and 3523-2 provided mitigations for Spectre and Meltdown
(CVE-2017-5715, CVE-2017-5753, CVE-2017-5754) for the i386, amd64,
and ppc64el architectures for Ubuntu 16.04 LTS. This update provides
the corresponding mitigations for the arm64 architecture. Original
advisory details:
Jann Horn discovered that microprocessors utilizing speculative execution
and indirect branch prediction may allow unauthorized memory reads via
sidechannel attacks. This flaw is known as Meltdown. A local attacker could
use this to expose sensitive information, including ker
OSV
linux vulnerabilities
osv·2018-02-23·CVSS 7.8
CVE-2017-0750 [HIGH] linux vulnerabilities
linux vulnerabilities
It was discovered that an out-of-bounds write vulnerability existed in the
Flash-Friendly File System (f2fs) in the Linux kernel. An attacker could
construct a malicious file system that, when mounted, could cause a denial
of service (system crash) or possibly execute arbitrary code.
(CVE-2017-0750)
It was discovered that a race condition leading to a use-after-free
vulnerability existed in the ALSA PCM subsystem of the Linux kernel. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2017-0861)
It was discovered that the KVM implementation in the Linux kernel allowed
passthrough of the diagnostic I/O port 0x80. An attacker in a guest VM
could use this to cause a denial of service (system crash) in th
OSV
linux, linux-aws, linux-euclid vulnerabilities
osv·2018-01-23·CVSS 5.6
CVE-2017-5753 [MEDIUM] linux, linux-aws, linux-euclid vulnerabilities
linux, linux-aws, linux-euclid vulnerabilities
Jann Horn discovered that microprocessors utilizing speculative
execution and branch prediction may allow unauthorized memory
reads via sidechannel attacks. This flaw is known as Spectre. A
local attacker could use this to expose sensitive information,
including kernel memory. This update provides mitigations for the
i386 (CVE-2017-5753 only), amd64, ppc64el, and s390x architectures.
(CVE-2017-5715, CVE-2017-5753)
USN-3522-1 mitigated CVE-2017-5754 (Meltdown) for the amd64
architecture in Ubuntu 16.04 LTS. This update provides the
corresponding mitigations for the ppc64el architecture. Original
advisory details:
Jann Horn discovered that microprocessors utilizing speculative
execution and indirect branch prediction may allow unauthorized me
OSV
linux-lts-xenial, linux-aws vulnerabilities
osv·2018-01-23·CVSS 5.6
[MEDIUM] linux-lts-xenial, linux-aws vulnerabilities
linux-lts-xenial, linux-aws vulnerabilities
USN-3540-1 addressed vulnerabilities in the Linux kernel for Ubuntu
16.04 LTS. This update provides the corresponding updates for the
Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for
Ubuntu 14.04 LTS.
Jann Horn discovered that microprocessors utilizing speculative
execution and branch prediction may allow unauthorized memory
reads via sidechannel attacks. This flaw is known as Spectre. A
local attacker could use this to expose sensitive information,
including kernel memory. This update provides mitigations for the
i386 (CVE-2017-5753 only), amd64, ppc64el, and s390x architectures.
(CVE-2017-5715, CVE-2017-5753)
USN-3522-2 mitigated CVE-2017-5754 (Meltdown) for the amd64
architecture in the Linux Hardware Enablement (HWE) kernel
OSV
linux-hwe, linux-azure, linux-gcp, linux-oem vulnerabilities
osv·2018-01-23·CVSS 5.6
[MEDIUM] linux-hwe, linux-azure, linux-gcp, linux-oem vulnerabilities
linux-hwe, linux-azure, linux-gcp, linux-oem vulnerabilities
USN-3541-1 addressed vulnerabilities in the Linux kernel for Ubuntu
17.10. This update provides the corresponding updates for the
Linux Hardware Enablement (HWE) kernel from Ubuntu 17.10 for Ubuntu
16.04 LTS.
Jann Horn discovered that microprocessors utilizing speculative
execution and branch prediction may allow unauthorized memory
reads via sidechannel attacks. This flaw is known as Spectre. A
local attacker could use this to expose sensitive information,
including kernel memory. This update provides mitigations for the
i386 (CVE-2017-5753 only), amd64, ppc64el, and s390x architectures.
(CVE-2017-5715, CVE-2017-5753)
USN-3523-2 mitigated CVE-2017-5754 (Meltdown) for the amd64
architecture in the Linux Hardware Enablement (HW
Kernel
arm64: Turn on KPTI only on CPUs that need it
kernel_security·2018-01-19·CVSS 5.6
CVE-2017-5754 [MEDIUM] arm64: Turn on KPTI only on CPUs that need it
arm64: Turn on KPTI only on CPUs that need it
Whitelist Broadcom Vulcan/Cavium ThunderX2 processors in
unmap_kernel_at_el0(). These CPUs are not vulnerable to
CVE-2017-5754 and do not need KPTI when KASLR is off.
Acked-by: Will Deacon
Signed-off-by: Jayachandran C
Signed-off-by: Catalin Marinas
Kernel
KVM: PPC: Book3S: Provide information about hardware/firmware CVE workarounds
kernel_security·2018-01-15·CVSS 5.6
CVE-2017-5715 [MEDIUM] KVM: PPC: Book3S: Provide information about hardware/firmware CVE workarounds
KVM: PPC: Book3S: Provide information about hardware/firmware CVE workarounds
This adds a new ioctl, KVM_PPC_GET_CPU_CHAR, that gives userspace
information about the underlying machine's level of vulnerability
to the recently announced vulnerabilities CVE-2017-5715,
CVE-2017-5753 and CVE-2017-5754, and whether the machine provides
instructions to assist software to work around the vulnerabilities.
The ioctl returns two u64 words describing characteristics of the
CPU and required software behaviour respectively, plus two mask
words which indicate which bits have been filled in by the kernel,
for extensibility. The bit definitions are the same as for the
new H_GET_CPU_CHARACTERISTICS hypercall.
There is also a new capability, KVM_CAP_PPC_GET_CPU_CHAR, which
indicates whether the new ioctl
OSV
linux regression
osv·2018-01-10·CVSS 5.6
CVE-2017-5754 [MEDIUM] linux regression
linux regression
USN-3522-1 fixed a vulnerability in the Linux kernel to address
Meltdown (CVE-2017-5754). Unfortunately, that update introduced
a regression where a few systems failed to boot successfully. This
update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Jann Horn discovered that microprocessors utilizing speculative execution
and indirect branch prediction may allow unauthorized memory reads via
sidechannel attacks. This flaw is known as Meltdown. A local attacker could
use this to expose sensitive information, including kernel memory.
OSV
linux-lts-xenial regression
osv·2018-01-10·CVSS 5.6
CVE-2017-5754 [MEDIUM] linux-lts-xenial regression
linux-lts-xenial regression
USN-3522-2 fixed a vulnerability in the Linux Hardware Enablement
kernel for Ubuntu 14.04 LTS to address Meltdown (CVE-2017-5754).
Unfortunately, that update introduced a regression where a few systems
failed to boot successfully. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Jann Horn discovered that microprocessors utilizing speculative execution
and indirect branch prediction may allow unauthorized memory reads via
sidechannel attacks. This flaw is known as Meltdown. A local attacker could
use this to expose sensitive information, including kernel memory.
OSV
linux-hwe, linux-azure, linux-gcp, linux-oem vulnerabilities
osv·2018-01-10·CVSS 7.8
[HIGH] linux-hwe, linux-azure, linux-gcp, linux-oem vulnerabilities
linux-hwe, linux-azure, linux-gcp, linux-oem vulnerabilities
USN-3523-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.10.
This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 17.10 for Ubuntu
16.04 LTS.
Jann Horn discovered that microprocessors utilizing speculative execution
and indirect branch prediction may allow unauthorized memory reads via
sidechannel attacks. This flaw is known as Meltdown. A local attacker could
use this to expose sensitive information, including kernel memory.
(CVE-2017-5754)
Jann Horn discovered that the Berkeley Packet Filter (BPF) implementation
in the Linux kernel did not properly check the relationship between pointer
values and the BPF stack. A local attacker could use this to cause a denial
o
OSV
linux-lts-xenial, linux-aws vulnerability
osv·2018-01-09·CVSS 5.6
[MEDIUM] linux-lts-xenial, linux-aws vulnerability
linux-lts-xenial, linux-aws vulnerability
USN-3522-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 LTS.
Jann Horn discovered that microprocessors utilizing speculative execution
and indirect branch prediction may allow unauthorized memory reads via
sidechannel attacks. This flaw is known as Meltdown. A local attacker could
use this to expose sensitive information, including kernel memory.
(CVE-2017-5754)
OSV
firefox vulnerabilities
osv·2018-01-05·CVSS 5.6
CVE-2017-5715 [MEDIUM] firefox vulnerabilities
firefox vulnerabilities
It was discovered that speculative execution performed by modern CPUs
could leak information through a timing side-channel attack, and that
this could be exploited in web browser JavaScript engines. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit this to obtain sensitive information from other
domains, bypassing same-origin restrictions. (CVE-2017-5715,
CVE-2017-5753, CVE-2017-5754).
OSV
CVE-2017-5754: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an att
osv·2018-01-04·CVSS 5.6
CVE-2017-5754 [MEDIUM] CVE-2017-5754: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an att
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.
Project0
Reading privileged memory with a side-channel - Project Zero
project_zero·2018-01-01·CVSS 5.6
CVE-2017-5715 [MEDIUM] Reading privileged memory with a side-channel - Project Zero
Posted by Jann Horn, Project Zero
We have discovered that CPU data cache timing can be abused to efficiently leak information out of mis-speculated execution, leading to (at worst) arbitrary virtual memory read vulnerabilities across local security boundaries in various contexts.
Variants of this issue are known to affect many modern processors, including certain processors by Intel, AMD and ARM. For a few Intel and AMD CPU models, we have exploits that work against real software. We reported this issue to Intel, AMD and ARM on 2017-06-01 [1].
So far, there are three known variants of the issue:
-
Variant 1: bounds check bypass (CVE-2017-5753)
-
Variant 2: branch target injection (CVE-2017-5715)
-
Variant 3: rogue data cache load (CVE-2017-5754)
Before the issues described he
Suricata
ET EXPLOIT Possible MeltDown PoC Download In Progress
suricata·2018-01-10
CVE-2017-5754 ET EXPLOIT Possible MeltDown PoC Download In Progress
ET EXPLOIT Possible MeltDown PoC Download In Progress
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible MeltDown PoC Download In Progress"; flow:established,to_client; flowbits:isset,ET.http.binary; file.data; content:"|57 53 41 50 41 51|"; content:"|0F AE F0|"; distance:50; within:53; content:"|0F AE|"; distance:15; within:12; pcre:"/^[\x30-\x3f\x7D]/Rs"; content:"|0F AE F0 0F 31|"; distance:45; within:25; content:"|0F AE F0 0F 31|"; distance:17; within:12; reference:cve,2017-5754; classtype:attempted-admin; sid:2025195; rev:3; metadata:attack_target Client_Endpoint, created_at 2018_01_10, cve CVE_2017_5754, deployment Perimeter, malware_family MeltDown_Exploit, performance_impact Low, confidence Medium, signature_severity Major, updated_at 2024_03_14;)
Greynoiseio
GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs
blogs_greynoiseio·2025-02-26·CVSS 9.8
[CRITICAL] GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Qualys
Defense Lessons From the Black Basta Ransomware Playbook
blogs_qualys·2025-02-25
Defense Lessons From the Black Basta Ransomware Playbook
## Table of Contents
Know Your Enemys Playbook
Attackers Move Fast
How Qualys Can Help
The cybersecurity world was rocked last week by a massive leak of Black Basta’s internal communications that emerged from the group’s chat logs. Triggered by internal conflicts and a retaliatory data dump following attacks on Russian banks, the exposed records offer a rare glimpse into Black Basta’s tactics, operations, and leadership.
We’ve analyzed these newly unveiled tactics, and in this blog, we equip security teams with clear, actionable insights. We aim to highlight the key lessons learned—like immediate patching, tighter access controls, and rapid incident response—and provide an urgent call to action. This practical guide aims to help organizations strengthen their defenses against evolving
Qualys
Defense Lessons From the Black Basta Ransomware Playbook | Qualys
blogs_qualys·2025-02-25
Defense Lessons From the Black Basta Ransomware Playbook | Qualys
#### Table of Contents
- Know Your Enemys Playbook
- Attackers Move Fast
- How Qualys Can Help
The cybersecurity world was rocked last week by a massive leak of Black Basta’s internal communications that emerged from the group’s chat logs. Triggered by internal conflicts and a retaliatory data dump following attacks on Russian banks, the exposed records offer a rare glimpse into Black Basta’s tactics, operations, and leadership.
We’ve analyzed these newly unveiled tactics, and in this blog, we equip security teams with clear, actionable insights. We aim to highlight the key lessons learned—like immediate patching, tighter access controls, and rapid incident response—and provide an urgent call to action. This practical guide aims to help organizations strengthen their defenses against ev
Tenable
From Bugs to Breaches: 25 Significant CVEs As MITRE CVE Turns 25
blogs_tenable·2024-10-22
From Bugs to Breaches: 25 Significant CVEs As MITRE CVE Turns 25
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Sentinelone
Black Basta
blogs_sentinelone·2022-11-30
Black Basta
How It Works The Singularity XDR Difference
Singularity Marketplace One-Click Integrations to Unlock the Power of XDR
Pricing & Packaging Comparisons and Guidance at a Glance
Purple AI Accelerate SecOps with Generative AI
Singularity Hyperautomation Easily Automate Security Processes
AI-SIEM The AI SIEM for the Autonomous SOC
Singularity Data Lake AI-Powered, Unified Data Lake
Singularity Data Lake for Log Analytics Seamlessly Ingest Data from On-Prem, Cloud or Hybrid Environments
Singularity Endpoint Autonomous Prevention, Detection, and Response
Singularity XDR Native & Open Protection, Detection, and Response
Singularity RemoteOps Forensics Orchestrate Forensics at Scale
Singularity
Threat Intelligence Comprehensive Adversary Intelligence
Singularity Vulnerability Management
Tenable
Spectre and Meltdown
blogs_tenable·2022-11-07·CVSS 5.6
[MEDIUM] Spectre and Meltdown
by Carole Fennelly November 7, 2022
A compromised processor is one of the most serious attack vectors on any platform. The hardware bugs known as Spectre and Meltdown affect modern processors by accessing information found in the system's memory. The Spectre and Meltdown dashboard provides insight into which systems are affected by these hardware bugs.
The Spectre and Meltdown bugs use side channels to obtain information from the accessed memory location. Spectre allows an application to force another application to access arbitrary portions of its memory, which can then be read through a side channel. This unique side channel attack uses speculative execution, a technique used by high-speed processors, to increase performance by guessing likely future execution paths and preemptively ex
Tenable
Getting Started with Tenable.sc Using SLA's
blogs_tenable·2020-01-10
Getting Started with Tenable.sc Using SLA's
by Cody Dumont January 10, 2020
Service Level Agreements often change from one organizations to the next, however meeting SLA’s is a common issue among organizations industry wide. Tenable.sc provides a vast array of data that provides vulnerability management SLA metrics, but where can the CISO get started? This dashboard is commonly used by the sales team at Tenable to help coach organizations to meet SLA’s. The components in this dashboard are grouped in 3-series, which provide a CISO and Risk Manager with a starting point for SLA analysis.
The first few rows provide a detailed analysis on SLA’s for vulnerabilities based on Common Vulnerability Scoring System (CVSS) and Vulnerability Priority Rating (VPR). Traditionally many SLA’s are based on Microsoft’s Patch Tuesday and provide org
Securelist
Kaspersky Security Bulletin 2018. Top security stories
blogs_securelist·2018-12-03
Kaspersky Security Bulletin 2018. Top security stories
Table of Contents
- Introduction
- Targeted attack campaigns
- Mobile APT campaigns
- Exploits
- Browser extensions – extending the reach of cybercriminals
- The World Cup of fraud
- Financial fraud on an industrial scale
- Ransomware – still a threat
- Asacub and banking Trojans
- Smart doesn’t mean secure
- Our data in their hands
Authors
- David Emm
- Victor Chebyshev
- Kaspersky Security Bulletin 2018. Statistics
- Kaspersky Security Bulletin 2018. Story of the year: miners
- Kaspersky Security Bulletin 2018. Threat Predictions for 2019
## Introduction
The internet is now woven into the fabric of our lives. Many people routinely bank, shop and socialize online and the internet is the lifeblood of commercial organizations. The dependence on technology of governments, businesses a
Securelist
Kaspersky Security Bulletin 2018. Top security stories
blogs_securelist·2018-12-03
Kaspersky Security Bulletin 2018. Top security stories
Table of Contents
Introduction
Targeted attack campaigns
Mobile APT campaigns
Exploits
Browser extensions – extending the reach of cybercriminals
The World Cup of fraud
Financial fraud on an industrial scale
Ransomware – still a threat
Asacub and banking Trojans
Smart doesn’t mean secure
Our data in their hands
Authors
David Emm
Victor Chebyshev
Kaspersky Security Bulletin 2018. Statistics
Kaspersky Security Bulletin 2018. Story of the year: miners
Kaspersky Security Bulletin 2018. Threat Predictions for 2019
## Introduction
The internet is now woven into the fabric of our lives. Many people routinely bank, shop and socialize online and the internet is the lifeblood of commercial organizations. The dependence on technology of governments, businesses and consumers provide
Tenable
5W1H: Speculative Side Channel Vulnerabilities De-mystified
blogs_tenable·2018-11-15·CVSS 5.6
[MEDIUM] 5W1H: Speculative Side Channel Vulnerabilities De-mystified
Blog / Research
Subscribe
# 5W1H: Speculative Side Channel Vulnerabilities De-mystified
Pablo Ramos
November 15, 2018
5 Min Read
The classes of vulnerabilities that brought us Meltdown and Spectre are not going away anytime soon. Here’s what you need to know about Speculative Execution vulnerabilities, with our guidance on steps you can take to reduce your risk.
Spectre and Meltdown generated a lot of confusion and discussion in the security world when they first hit the news. Understanding the risks associated with speculative execution vulnerabilities will help organizations prioritize and communicate effectively about their exposure. In this post, we present what it is known, how it affects companies and ways to stay ahead in the game.
## Start from the beginning…
Speculative Ex
Tenable
5W1H: Speculative Side Channel Vulnerabilities De-mystified
blogs_tenable·2018-11-15
5W1H: Speculative Side Channel Vulnerabilities De-mystified
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Securelist
IT threat evolution Q1 2018
blogs_securelist·2018-05-14
IT threat evolution Q1 2018
Authors
- David Emm
## Targeted attacks and malware campaigns
### Skygofree: sophisticated mobile surveillance
In January, we uncovered a sophisticated mobile implant that provides attackers with remote control of infected Android devices. The malware, called Skygofree (after one of the domains it uses), is a targeted cyber-surveillance tool that has been in development since 2014. The malware is spread by means of spoofed web pages that mimic leading mobile providers. The campaign is ongoing and our telemetry indicates that there have been several victims, all in Italy. We feel confident that the developer of Skygofree is an Italian IT company that works on surveillance solutions.
The latest version of Skygofree includes functionality that has so far not been seen in the wild. Featur
Securelist
IT threat evolution Q1 2018
blogs_securelist·2018-05-14
IT threat evolution Q1 2018
Authors
David Emm
## Targeted attacks and malware campaigns
## Skygofree: sophisticated mobile surveillance
In January, we uncovered a sophisticated mobile implant that provides attackers with remote control of infected Android devices. The malware, called Skygofree (after one of the domains it uses), is a targeted cyber-surveillance tool that has been in development since 2014. The malware is spread by means of spoofed web pages that mimic leading mobile providers. The campaign is ongoing and our telemetry indicates that there have been several victims, all in Italy. We feel confident that the developer of Skygofree is an Italian IT company that works on surveillance solutions.
The latest version of Skygofree includes functionality that has so far not been seen in the wild. Features
Qualys
Apple in the InfoSec Spotlight, as GitHub Falls Prey to Amplified DDoS Attack
blogs_qualys·2018-03-02
Apple in the InfoSec Spotlight, as GitHub Falls Prey to Amplified DDoS Attack
Apple has been all over InfoSec news in the past week or so, along with Spectre / Meltdown developments, a tax season scam alert from the feds, and an apparent solution to the Winter Olympics’ hack whodunit. In addition, researchers warned about a new trend of using Memcached servers to significantly boost DDoS attacks, as GitHub became a victim of this new tactic.
## Apple under siege
The second half of February was intense for Apple on the security front. A digital forensics vendor claimed having the ability to unlock all iPhone models, including the X, while a researcher warned about a Trojan targeting MacOs computers that’s not detected by anti-virus products. Oh, and Apple had to squash another one of those pesky bugs that let people crash iPhones via texting.
Unlocking iPhones
Fo
Qualys
Apple in the InfoSec Spotlight, as GitHub Falls Prey to Amplified DDoS Attack | Qualys
blogs_qualys·2018-03-02
Apple in the InfoSec Spotlight, as GitHub Falls Prey to Amplified DDoS Attack | Qualys
Apple has been all over InfoSec news in the past week or so, along with Spectre / Meltdown developments, a tax season scam alert from the feds, and an apparent solution to the Winter Olympics’ hack whodunit. In addition, researchers warned about a new trend of using Memcached servers to significantly boost DDoS attacks, as GitHub became a victim of this new tactic.
### Apple under siege
A digital forensics vendor claims it can crack iOS devices, including the iPhone X, pictured here. (Photo credit: Apple)
The second half of February was intense for Apple on the security front. A digital forensics vendor claimed having the ability to unlock all iPhone models, including the X, while a researcher warned about a Trojan targeting MacOs computers that’s not detected by anti-virus products. Oh
Qualys
Olympics, Patch Tuesday & Meltdown/Spectre | Qualys
blogs_qualys·2018-02-16
Olympics, Patch Tuesday & Meltdown/Spectre | Qualys
This week offered a representative sampling of different corners of the cyber security world: The monthly Patch Tuesday, a brazen attack against the Olympics, new Meltdown and Spectre concerns, and a boost for Intel’s bug bounty program.
Oh, and the gargantuan Equifax data breach may have been even bigger than previously thought.
### Winter Olympics hack confirmed
The 2018 Winter Olympics in Pyeongchang, South Korea are in full swing, featuring the world’s best ice skaters, skiers, hockey players and snowboarders, and also attracting, unfortunately, malicious hackers.
Attackers’ goals seem to be to disrupt the games in a variety of ways by interfering with and disabling IT systems.
Officials confirmed that hackers disrupted the opening ceremony by knocking the Winter Olympics’ website
Qualys
Hackers Hit the Olympics, While Patch Tuesday and Meltdown / Spectre Keep IT Departments On Edge
blogs_qualys·2018-02-16
Hackers Hit the Olympics, While Patch Tuesday and Meltdown / Spectre Keep IT Departments On Edge
This week offered a representative sampling of different corners of the cyber security world: The monthly Patch Tuesday, a brazen attack against the Olympics, new Meltdown and Spectre concerns, and a boost for Intel’s bug bounty program.
Oh, and the gargantuan Equifax data breach may have been even bigger than previously thought.
## Winter Olympics hack confirmed
The 2018 Winter Olympics in Pyeongchang, South Korea are in full swing, featuring the world’s best ice skaters, skiers, hockey players and snowboarders, and also attracting, unfortunately, malicious hackers.
Attackers’ goals seem to be to disrupt the games in a variety of ways by interfering with and disabling IT systems.
Officials confirmed that hackers disrupted the opening ceremony by knocking the Winter Olympics’ website
Qualys
Intel Makes Spectre Patch Progress, while Adobe Grapples with Latest Flash Bug
blogs_qualys·2018-02-09
Intel Makes Spectre Patch Progress, while Adobe Grapples with Latest Flash Bug
It’s been a busy week in InfoSec land, as Intel released a new Spectre patch, iOS source code was leaked online, and a zero-day Flash bug got exploited in the wild.
Also making noise these past few days: A major security hole in the Grammarly web app, WordPress updates tripping over each other, and a data breach at a Swiss telecom company.
As has been the case these past few weeks, we’ll lead off with the latest on Meltdown and Spectre, the hardware vulnerabilities whose disclosure on Jan. 3 sent shockwaves through the IT industry due to their scope and severity, and which are expected to remain an issue for years.
## Intel mitigates Spectre vulnerability with Skylake update
For a change, the latest Meltdown / Spectre development is encouraging: On Wednesday, Intel announced some progr
Qualys
Intel Makes Spectre Patch Progress, while Adobe Grapples with Latest Flash Bug | Qualys
blogs_qualys·2018-02-09
Intel Makes Spectre Patch Progress, while Adobe Grapples with Latest Flash Bug | Qualys
It’s been a busy week in InfoSec land, as Intel released a new Spectre patch, iOS source code was leaked online, and a zero-day Flash bug got exploited in the wild.
Also making noise these past few days: A major security hole in the Grammarly web app, WordPress updates tripping over each other, and a data breach at a Swiss telecom company.
As has been the case these past few weeks, we’ll lead off with the latest on Meltdown and Spectre, the hardware vulnerabilities whose disclosure on Jan. 3 sent shockwaves through the IT industry due to their scope and severity, and which are expected to remain an issue for years.
### Intel mitigates Spectre vulnerability with Skylake update
For a change, the latest Meltdown / Spectre development is encouraging: On Wednesday, Intel announced some prog
Qualys
Meltdown / Spectre: New Concerns Over Intel Patches, as Hackers Test Exploits
blogs_qualys·2018-02-02·CVSS 5.6
[MEDIUM] Meltdown / Spectre: New Concerns Over Intel Patches, as Hackers Test Exploits
This week brought new developments in the Meltdown / Spectre saga, including more concerns about Intel’s buggy patches, and mounting evidence that hackers are trying to create exploits for the vulnerabilities.
It seemed that after weeks of complaints and confusion , Intel’s issue had hit bottom and was headed for a resolution on Monday of last week. That’s when the company said its firmware updates for Broadwell and Haswell CPUs shouldn’t be installed anymore , because, as many customers had reported, they made systems behave erratically, including unexpectedly rebooting.
At the time, Intel said it had discovered the “root cause” for the firmware’s problems, and was already actively developing new updates. However, another shoe was about to drop. Three days later Intel acknowledged in it
Qualys
Meltdown / Spectre: New Concerns Over Intel Patches, as Hackers Test Exploits | Qualys
blogs_qualys·2018-02-02·CVSS 5.6
[MEDIUM] Meltdown / Spectre: New Concerns Over Intel Patches, as Hackers Test Exploits | Qualys
This week brought new developments in the Meltdown / Spectre saga, including more concerns about Intel’s buggy patches, and mounting evidence that hackers are trying to create exploits for the vulnerabilities.
It seemed that after weeks of complaints and confusion, Intel’s issue had hit bottom and was headed for a resolution on Monday of last week. That’s when the company said its firmware updates for Broadwell and Haswell CPUs shouldn’t be installed anymore, because, as many customers had reported, they made systems behave erratically, including unexpectedly rebooting.
At the time, Intel said it had discovered the “root cause” for the firmware’s problems, and was already actively developing new updates. However, another shoe was about to drop. Three days later Intel acknowledged in its
Fortinet
Meltdown/Spectre Update
blogs_fortinet·2018-01-30·CVSS 5.6
CVE-2017-5715 [MEDIUM] Meltdown/Spectre Update
FORTIGUARD LABS THREAT RESEARCH
Meltdown/Spectre Update
By FortiGuard SE Team | January 30, 2018
Earlier this month, three major chip manufacturers announced that vulnerabilities known as Meltdown and Spectre (CVE-2017-5715, CVE-2017-5753 and CVE-2017-5754) affected processors deployed in millions of devices.
For the past year or so, FortiGuard Labs has been tracking the efforts of cybercriminals to develop new attacks designed to exploit known vulnerabilities. As detailed in our Fortinet Threat Report for Q2 of 2017, a full 90% of organizations recorded exploits for vulnerabilities that were three or more years old. Even 10+ years after a flaw’s release, 60% of firms still see related attacks.
The rate at which the cybercriminal community is targeting known vulnerabilities is clearly
Qualys
Meltdown/Spectre: Intel Nixes Patches, Tech CEOs Questioned on Information Blackout
blogs_qualys·2018-01-26
Meltdown/Spectre: Intel Nixes Patches, Tech CEOs Questioned on Information Blackout
IT departments and tech vendors continued grappling with Spectre and Meltdown this week, as Intel pulled its glitchy patches and the U.S. Congress questioned the vulnerability disclosures’ timing and scope.
Spectre and Meltdown aren’t typical vulnerabilities for a number of reasons, and as a result, they’ve proven problematic to deal with. Intel, whose products are the most impacted, has had a particularly rocky time crafting its firmware updates for mitigating the bugs.
After receiving multiple complaints from customers, in particular data center operators, that the firmware updates for Broadwell and Haswell CPUs were causing systems to unexpectedly reboot, Intel on Monday finally deep-sixed them .
“We recommend that OEMs, cloud service providers, system manufacturers, software vendors
Qualys
Meltdown/Spectre: Intel Nixes Patches, Tech CEOs Questioned on Information Blackout | Qualys
blogs_qualys·2018-01-26
Meltdown/Spectre: Intel Nixes Patches, Tech CEOs Questioned on Information Blackout | Qualys
IT departments and tech vendors continued grappling with Spectre and Meltdown this week, as Intel pulled its glitchy patches and the U.S. Congress questioned the vulnerability disclosures’ timing and scope.
Spectre and Meltdown aren’t typical vulnerabilities for a number of reasons, and as a result, they’ve proven problematic to deal with. Intel, whose products are the most impacted, has had a particularly rocky time crafting its firmware updates for mitigating the bugs.
After receiving multiple complaints from customers, in particular data center operators, that the firmware updates for Broadwell and Haswell CPUs were causing systems to unexpectedly reboot, Intel on Monday finally deep-sixed them.
“We recommend that OEMs, cloud service providers, system manufacturers, software vendors
Qualys
Meltdown and Spectre Aren’t Business as Usual | Qualys
blogs_qualys·2018-01-18·CVSS 5.6
[MEDIUM] Meltdown and Spectre Aren’t Business as Usual | Qualys
The new year brought a new vulnerability type — the CPU-based Meltdown and Spectre bugs — that’s forcing vendors and IT departments to modify long-standing ways of identifying threats, prioritizing remediation, managing patches and evaluating risk.
“Meltdown and Spectre are different vulnerabilities from what you’re used to seeing,” Jimmy Graham, a Product Management Director at Qualys, said during a webcast on Wednesday.
As a result, it’s essential for organizations to fully understand the nature of these vulnerabilities, stay on top of the latest information, and analyze the vulnerabilities’ impact in their IT environments, in order to stay as safe as possible.
“It’s not a simple [process] of just install a patch and you’re done,” he said.
### A different animal
Graham outlined a nu
Qualys
Meltdown and Spectre Aren’t Business as Usual
blogs_qualys·2018-01-18·CVSS 5.6
[MEDIUM] Meltdown and Spectre Aren’t Business as Usual
The new year brought a new vulnerability type — the CPU-based Meltdown and Spectre bugs — that’s forcing vendors and IT departments to modify long-standing ways of identifying threats, prioritizing remediation, managing patches and evaluating risk.
“Meltdown and Spectre are different vulnerabilities from what you’re used to seeing,” Jimmy Graham, a Product Management Director at Qualys, said during a webcast on Wednesday.
As a result, it’s essential for organizations to fully understand the nature of these vulnerabilities, stay on top of the latest information, and analyze the vulnerabilities’ impact in their IT environments, in order to stay as safe as possible.
“It’s not a simple [process] of just install a patch and you’re done,” he said.
## A different animal
Graham outlined a num
Fortinet
Dr. StrangePatch or: How I Learned to Stop Worrying (about Meltdown and Spectre) and Love Security Advisory ADV180002
blogs_fortinet·2018-01-12
Dr. StrangePatch or: How I Learned to Stop Worrying (about Meltdown and Spectre) and Love Security Advisory ADV180002
FORTIGUARD LABS THREAT RESEARCH
Dr. StrangePatch or: How I Learned to Stop Worrying (about Meltdown and Spectre) and Love Security Advisory ADV180002
By Minh Tran | January 12, 2018
Introduction
2018 truly is starting off with a bang: fundamental CPU flaws dubbed Meltdown and Spectre were found affecting pretty much all modern processors developed since the Pentium Pro (1995). These flaws root in two critical CPU features: Out of Order Execution and Speculative Execution, which are crucial for performance. Since this is an important feature and not a bug, it is inherently hard to fix. Furthermore, for performance reasons, speculative execution is almost always implemented in hardware, so “fixes” tend toward mitigations (e.g. microcode updates).
Due to the serious nature of these flaws,
Qualys
Meltdown/Spectre and Qualys Cloud Platform | Qualys
blogs_qualys·2018-01-09·CVSS 5.6
[MEDIUM] Meltdown/Spectre and Qualys Cloud Platform | Qualys
In light of the recently released information about two security vulnerabilities, Qualys has considered the impact on the Qualys Cloud Platform and associated services. Qualys released a detailed advisory for customers of the Qualys Cloud Platform to help customers identify these vulnerabilities and to assist customers in their internal security assessment.
Below, please find information about how Qualys has performed its assessment and is taking steps to protect its environment and the Qualys Cloud Platform:
### About Meltdown and Spectre
Meltdown (CVE-2017-5754) and Spectre (CVE-2017-5715 and CVE-2017-5753) exploit physical implementations of modern microprocessors, rather than relying on any software-based flaw or defect.
### Impact
As of this writing, there is no known exploit for
Qualys
Meltdown/Spectre and Qualys Cloud Platform
blogs_qualys·2018-01-09·CVSS 5.6
[MEDIUM] Meltdown/Spectre and Qualys Cloud Platform
In light of the recently released information about two security vulnerabilities, Qualys has considered the impact on the Qualys Cloud Platform and associated services. Qualys released a detailed advisory for customers of the Qualys Cloud Platform to help customers identify these vulnerabilities and to assist customers in their internal security assessment.
Below, please find information about how Qualys has performed its assessment and is taking steps to protect its environment and the Qualys Cloud Platform:
## About Meltdown and Spectre
Meltdown (CVE-2017-5754) and Spectre (CVE-2017-5715 and CVE-2017-5753) exploit physical implementations of modern microprocessors, rather than relying on any software-based flaw or defect.
## Impact
As of this writing, there is no known exploit for t
Qualys
January 2018 Patch Tuesday - Meltdown/Spectre, 16 Critical Microsoft Patches, 1 Adobe Patch | Qualys
blogs_qualys·2018-01-09·CVSS 5.6
[MEDIUM] January 2018 Patch Tuesday - Meltdown/Spectre, 16 Critical Microsoft Patches, 1 Adobe Patch | Qualys
Due to the disclosure of Meltdown and Spectre, Microsoft released several patches last week with the ranking “Important.” While there are no active attacks against these vulnerabilities, a special focus should be placed on any of the browser patches, due to potential attacks using JavaScript.
It is important to note that OS-level and BIOS (microcode) patches that are designed to mitigate Meltdown and Spectre may lead to performance issues. It is important to test all patches before deploying.
Some of these updates are incompatible with third-party antivirus software, and may require updating AV on workstations and servers. Microsoft has released guidance documents for both Windows clients and servers. Windows Server requires registry changes in order to implement the protections added by
Checkpoint
Detection of the Meltdown and Spectre Vulnerabilities
blogs_checkpoint·2018-01-09·CVSS 5.6
CVE-2017-5754 [MEDIUM] Detection of the Meltdown and Spectre Vulnerabilities
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
AI Research 2
Android Malware 23
Artificial Intelligence 4
ChatGPT 3
Check Point Research Publications 455
Cloud Security 1
CPRadio 44
Crypto 2
Data & Threat Intelligence 2
Data Analysis 0
Demos 22
Global Cyber Attack Reports 408
How To Guides 13
Ransomware 5
Russo-Ukrainian War 1
Security Report 1
Threat and data analysis 0
Threat Research 174
Web 3.0 Security 11
Wipers 0
## Detection of the Meltdown and Spectre Vulnerabilities
Research By: Erez Israel, Daniel Marx, Yoav Alon, Aviv Gafni and Ben Omelchenko
Last week, two publications regarding a pair of vulne
Qualys
January 2018 Patch Tuesday – Meltdown/Spectre, 16 Critical Microsoft Patches, 1 Adobe Patch
blogs_qualys·2018-01-09·CVSS 5.6
[MEDIUM] January 2018 Patch Tuesday – Meltdown/Spectre, 16 Critical Microsoft Patches, 1 Adobe Patch
Due to the disclosure of Meltdown and Spectre , Microsoft released several patches last week with the ranking “Important.” While there are no active attacks against these vulnerabilities, a special focus should be placed on any of the browser patches, due to potential attacks using JavaScript.
It is important to note that OS-level and BIOS (microcode) patches that are designed to mitigate Meltdown and Spectre may lead to performance issues. It is important to test all patches before deploying.
Some of these updates are incompatible with third-party antivirus software, and may require updating AV on workstations and servers. Microsoft has released guidance documents for both Windows clients and servers . Windows Server requires registry changes in order to implement the protections added
Talos
Meltdown and Spectre
blogs_talos·2018-01-08·CVSS 5.6
[MEDIUM] Meltdown and Spectre
## Meltdown and Spectre
Cisco Talos is aware of three new vulnerabilities impacting Intel, AMD, Qualcomm and ARM processors used by almost all computers. We are investigating these issues and although we have not observed exploitation of these vulnerabilities in the wild, that does not mean that it has not occurred. We have observed publicly available proof of concept exploit code being developed to exploit these vulnerabilities.
These issues have been assigned the following CVE entries:
Meltdown: An attacker can access kernel memory from user space
Rogue data cache load ( CVE-2017-5754 ) Spectre: An attacker can read memory contents from other users' running programs
Branch target injection ( CVE-2017-5715 )
Bounds check bypass ( CVE-2017-5753 ) These issues involve side channel and
Talos
Meltdown and Spectre
blogs_talos·2018-01-08·CVSS 5.6
[MEDIUM] Meltdown and Spectre
Cisco Talos is aware of three new vulnerabilities impacting Intel, AMD, Qualcomm and ARM processors used by almost all computers. We are investigating these issues and although we have not observed exploitation of these vulnerabilities in the wild, that does not mean that it has not occurred. We have observed publicly available proof of concept exploit code being developed to exploit these vulnerabilities.
These issues have been assigned the following CVE entries:
Meltdown: An attacker can access kernel memory from user space
- Rogue data cache load (CVE-2017-5754) Spectre: An attacker can read memory contents from other users' running programs
- Branch target injection (CVE-2017-5715)
- Bounds check bypass (CVE-2017-5753)
These issues involve side channel and cache attacks that enable
Trendmicro
Understanding Meltdown and Spectre
blogs_trendmicro·2018-01-05
Understanding Meltdown and Spectre
Exploits & Vulnerabilities
# Understanding Meltdown and Spectre
After the official disclosure of the Meltdown and Spectre vulnerabilities, it became clear how serious the problems were. In short, Meltdown and Spectre both allow malicious code to read memory that they would normally not have permission to.
By: Vit Sembera
2018/01/05
Read time: ( words)
Save to Folio
For several days, rumors circulated about a serious vulnerability in Intel processors. It wasn’t until January 3 that the official disclosure of the Meltdown and Spectre vulnerabilities was made, and it became clear how serious the problems were. To summarize, Meltdown and Spectre both allow malicious code to read memory that they would normally not have permission to.
The vulnerability can allow an attacker to steal info
Zscaler
Meltdown, Spectre, CPU Side-Channel Attack | Zscaler Blog
blogs_zscaler·2018-01-05
Meltdown, Spectre, CPU Side-Channel Attack | Zscaler Blog
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Tenable
The First Major Security Logos of 2018: Spectre and Meltdown Vulnerabilities
blogs_tenable·2018-01-04
The First Major Security Logos of 2018: Spectre and Meltdown Vulnerabilities
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Qualys
Processor Vulnerabilities – Meltdown and Spectre
blogs_qualys·2018-01-04·CVSS 5.6
CVE-2017-5754 [MEDIUM] Processor Vulnerabilities – Meltdown and Spectre
UPDATE 1/4/2018: Qualys has released several QIDs for detecting missing patches for these vulnerabilities.
UPDATE 1/5/2018: Pre-built AssetView dashboards to visualize impact and remediation progress.
Vulnerabilities potentially impacting all major processor vendors were disclosed today by Google Project Zero. These vulnerabilities have been named Meltdown (CVE-2017-5754) and Spectre (CVE-2017-5753 & CVE-2017-5715). Organizations should inventory their systems by processor type, apply vendor patches as they become available, and track their progress. This article describes how Qualys can help in all three areas.
## Overview
Meltdown allows any application to access all system memory, including memory allocated for the kernel. Mitigation for this vulnerability will require operating syst
Sentinelone
SentinelOne is Compatible with “Meltdown” and “Spectre” Fixes
blogs_sentinelone·2018-01-04·CVSS 5.6
CVE-2017-5753 [MEDIUM] SentinelOne is Compatible with “Meltdown” and “Spectre” Fixes
This document covers SentinelOne’s response to exploit flaws described in CVE-2017-5753, CVE-2017-5715, and CVE-2017-5754.
SentinelOne products are compatible with Microsoft’s January 3, 2018, security updates. We tested our Agent against Microsoft’s patch. No incompatibilities causing any stop errors or other issues were found with SentinelOne agent versions 1.8.4, 2.0, 2.1 and 2.5.
## Overview
Microsoft, Google, Linux RedHat and Amazon have all acknowledged a new, publicly disclosed class of vulnerabilities referred to as “speculative execution side-channel attacks,” which affect many modern processors and operating systems including Intel, AMD, and ARM. This issue may also affect other systems, such as Android, Chrome, iOS, MacOS.
## Possible collision with security applications
Mi
Sentinelone
SentinelOne is Compatible with “Meltdown” and “Spectre” Fixes
blogs_sentinelone·2018-01-04·CVSS 5.6
CVE-2017-5753 [MEDIUM] SentinelOne is Compatible with “Meltdown” and “Spectre” Fixes
This document covers SentinelOne’s response to exploit flaws described in CVE-2017-5753 , CVE-2017-5715 , and CVE-2017-5754 .
SentinelOne products are compatible with Microsoft’s January 3, 2018, security updates. We tested our Agent against Microsoft’s patch. No incompatibilities causing any stop errors or other issues were found with SentinelOne agent versions 1.8.4, 2.0, 2.1 and 2.5.
## Overview
Microsoft , Google , Linux RedHat and Amazon have all acknowledged a new, publicly disclosed class of vulnerabilities referred to as “speculative execution side-channel attacks,” which affect many modern processors and operating systems including Intel, AMD, and ARM. This issue may also affect other systems, such as Android, Chrome, iOS, MacOS.
## Possible collision with security application
Unit42
Threat Brief: Meltdown and Spectre Vulnerabilities
blogs_unit42·2018-01-04·CVSS 5.6
[MEDIUM] Threat Brief: Meltdown and Spectre Vulnerabilities
Bottom line up front:
- The Meltdown and Spectre vulnerabilities are serious vulnerabilities
- These vulnerabilities are uniquely broad in scope potentially affecting nearly every computer and device with a modern processor: Microsoft Windows, Google Android, Google ChromeOS, Apple macOS, on Intel and ARM processors.
- These are not code execution vulnerabilities (i.e. wormable): they are information disclosure vulnerabilities
- These vulnerabilities pose greatest risk in shared hosting scenarios (i.e. cloud)
- The risk these vulnerabilities pose for end users is that malicious code or script could use them to obtain sensitive information like usernames, passwords, and bank account information
- Because of the breadth of these vulnerabilities, IoT devices and many mobile devices may never
Tenable
The First Major Security Logos of 2018: Spectre and Meltdown Vulnerabilities
blogs_tenable·2018-01-04
The First Major Security Logos of 2018: Spectre and Meltdown Vulnerabilities
Blog / Research
Subscribe
# The First Major Security Logos of 2018: Spectre and Meltdown Vulnerabilities
Cody Dumont
January 4, 2018
6 Min Read
This post was updated on Jan. 12, 2018 to include additional technical details and supplemental links.
The recently disclosed Meltdown and Spectre vulnerabilities started off 2018 with a somber note, as the attacks affect everything from desktops, laptops and mobile devices to cloud providers’ infrastructure. The flaws are present in nearly all modern microprocessors and can allow an attacker to access privileged memory by abusing a feature called speculative execution.
### Speculative execution
Speculative execution is a technique that allows a microprocessor to increase performance by operating on multiple branches of instructions at once
Unit42
Threat Brief: Meltdown and Spectre Vulnerabilities
blogs_unit42·2018-01-04
Threat Brief: Meltdown and Spectre Vulnerabilities
Threat Research Center
High Profile Threats
Vulnerabilities
## Threat Brief: Meltdown and Spectre Vulnerabilities
Unit 42
Published: January 4, 2018
High Profile Threats
Vulnerabilities
AMD
Android
ARM
Intel
Linux
MacOS
Microsoft Windows
Bottom line up front:
The Meltdown and Spectre vulnerabilities are serious vulnerabilities
These vulnerabilities are uniquely broad in scope potentially affecting nearly every computer and device with a modern processor: Microsoft Windows, Google Android, Google ChromeOS, Apple macOS, on Intel and ARM processors.
These are not code execution vulnerabilities (i.e. wormable): they are information disclosure vulnerabilities
These vulnerabilities pose greatest risk in shared hosting scenarios (i.e. cloud)
The risk these vulnerabilities po
Fortinet
Fortinet Advisory on New Spectre and Meltdown Vulnerabilities
blogs_fortinet·2018-01-04·CVSS 5.6
[MEDIUM] Fortinet Advisory on New Spectre and Meltdown Vulnerabilities
FORTINET NEWS & UPDATES
Fortinet Advisory on New Spectre and Meltdown Vulnerabilities
By Fortinet | January 04, 2018
Earlier this week, it was announced that researchers uncovered two new side channel attacks that exploit newly discovered vulnerabilities found in most CPU processors, including those from Intel, AMD, and ARM. These vulnerabilities allow malicious userspace processes to read kernel memory, thereby potentially causing sensitive kernel information to leak. These vulnerabilities are known as Meltdown and Spectre.
Fortinet’s PSIRT team is actively conducting an extensive review to determine the potential impact to Fortinet solutions, and at this time has classified the risk to Fortinet products as low. Meltdown and Spectre are "Information Disclosure" and "Privilege Escalatio
Qualys
Processor Vulnerabilities - Meltdown and Spectre | Qualys
blogs_qualys·2018-01-04·CVSS 5.6
CVE-2017-5754 [MEDIUM] Processor Vulnerabilities - Meltdown and Spectre | Qualys
UPDATE 1/4/2018: Qualys has released several QIDs for detecting missing patches for these vulnerabilities.
UPDATE 1/5/2018: Pre-built AssetView dashboards to visualize impact and remediation progress.
Vulnerabilities potentially impacting all major processor vendors were disclosed today by Google Project Zero. These vulnerabilities have been named Meltdown (CVE-2017-5754) and Spectre (CVE-2017-5753 & CVE-2017-5715). Organizations should inventory their systems by processor type, apply vendor patches as they become available, and track their progress. This article describes how Qualys can help in all three areas.
### Overview
Meltdown allows any application to access all system memory, including memory allocated for the kernel. Mitigation for this vulnerability will require operating sy
Tenable
Spectre & Meltdown
blogs_tenable·2018-01-04
Spectre & Meltdown
by Steve Tilson January 4, 2018
A compromised processor is one of the most serious attack vectors on all Microsoft, Apple, and Linux systems. The recent discovered hardware bugs known as “Spectre & Meltdown” affect modern processors uniquely by accessing information found in the system’s memory. This Dashboard can provide insight to which systems are prone to the new vulnerability.
The new bugs are considered side channel attacks since they use side channels to obtain the information from the accessed memory location. Spectre allows an application to force another application to access arbitrary portions of its memory, which can then be read through a side channel. This unique side channel attack is done by speculative execution, a technique used by high-speed processors in order to incr
Sentinelone
Black Basta
blogs_sentinelone
Black Basta
# Black Basta Ransomware: In-Depth Analysis, Detection, and Mitigation
## Summary of Black Basta Ransomware
Black Basta first emerged in early 2022. The ransomware family is an evolution of the Hermes/Ryuk/Conti families. Black Basta was heavily advertised in underground cybercrime markets. Black Basta practices double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data. There are Windows and LInux variants of Black Basta ransomware. The group is responsible for hundreds of attacks against global targets of varying sectors.
February 2025 Update: Nearly a year’s worth of Black Basta chat logs have been released on Telegram, providing detailed insight into the groups operational workflow, reconnaissance activities, and specific userID and details o
Crowdstrike
What are the Spectre & Meltdown Chip Flaws?
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] What are the Spectre & Meltdown Chip Flaws?
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
Bugzilla
CVE-2026-79609 xen: Xen: Denial of Service via guest page table access beyond direct memory mapping [fedora-all]
bugzilla·2026-10-22·CVSS 5.6
CVE-2026-79609 [MEDIUM] CVE-2026-79609 xen: Xen: Denial of Service via guest page table access beyond direct memory mapping [fedora-all]
CVE-2026-79609 xen: Xen: Denial of Service via guest page table access beyond direct memory mapping [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown
(CVE-2017-5754, one aspect of XSA-254). This involves copying 64-bit PV
guest page table entries from guest-chosen root page tables to the Xen-
chosen one which is in actual use by hardware. To read the guest root
page table, the directmap is used. PV guests, however, have a directmap
which may not cover all memory; in particular this is the case if any
memory extends beyond the 5 TiB (CONF
Bugzilla
CVE-2026-79609 xen: Xen: Denial of Service via guest page table access beyond direct memory mapping
bugzilla·2026-10-13·CVSS 5.6
CVE-2026-79609 [MEDIUM] CVE-2026-79609 xen: Xen: Denial of Service via guest page table access beyond direct memory mapping
CVE-2026-79609 xen: Xen: Denial of Service via guest page table access beyond direct memory mapping
XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown
(CVE-2017-5754, one aspect of XSA-254). This involves copying 64-bit PV
guest page table entries from guest-chosen root page tables to the Xen-
chosen one which is in actual use by hardware. To read the guest root
page table, the directmap is used. PV guests, however, have a directmap
which may not cover all memory; in particular this is the case if any
memory extends beyond the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) address
boundary.
Bugzilla
firefox: mitigations against spectre via javascript
bugzilla·2018-01-08·CVSS 5.6
CVE-2017-5754 [MEDIUM] firefox: mitigations against spectre via javascript
firefox: mitigations against spectre via javascript
Mozilla has issued an advisory (mfsa2018-01) for Firefox 57.0.4 that implements a short term mitigation for spectre based javascript attacks.
CVE-2017-5754 CVE-2017-5753
References:
https://www.mozilla.org/en-US/security/advisories/mfsa2018-01/
Discussion:
(In reply to Sam Fowler from comment #3)
> "The precision of performance.now() has been reduced from 5μs to 20μs"
According to the following Mozilla blog post:
https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/
this mitigation is going to be include in 52 ESR in version 52.6 ESR.
---
Statement:
Mozilla has confirmed that similar to "Meltdown" and "Spectre" which are a new class of timing attacks which affect modern CPUs, it is possible t
Bugzilla
CVE-2017-5754 kernel: hw: cpu: speculative execution permission faults handling [fedora-all]
bugzilla·2018-01-03·CVSS 5.6
CVE-2017-5754 [MEDIUM] CVE-2017-5754 kernel: hw: cpu: speculative execution permission faults handling [fedora-all]
CVE-2017-5754 kernel: hw: cpu: speculative execution permission faults handling [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple sup
Bugzilla
CVE-2017-5754 hw: cpu: speculative execution permission faults handling
bugzilla·2017-12-01·CVSS 5.6
CVE-2017-5754 [MEDIUM] CVE-2017-5754 hw: cpu: speculative execution permission faults handling
CVE-2017-5754 hw: cpu: speculative execution permission faults handling
An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimization). There are three primary variants of the issue which differ in the way the speculative execution can be exploited.
Variant CVE-2017-5754 relies on the fact that, on impacted microprocessors, during speculative execution of instruction permission faults, exception generation triggered by a faulting access is suppressed until the retirement of the whole instruction block. In a combination with the fact that memory accesses may populate the cache even when the block is being dropped and never committed (executed), an unprivileged local attacker c
arXiv
Fundamental Challenges in Cybersecurity and a Philosophy of Vulnerability-Guided Hardening
arxiv_fulltext·2024-09-03
Fundamental Challenges in Cybersecurity and a Philosophy of Vulnerability-Guided Hardening
Fundamental Challenges in Cybersecurity and\ Philosophy of Vulnerability-Guided Hardening
Marcel B\"ohme\ -SP, Germany-0.4cm
## Abstract
Research\,in\,cybersecurity\,may\,seem\,reactive,\,specific, ephemeral, and indeed ineffective. Despite decades of innovation in defense, even the most critical software systems turn out to be vulnerable to attacks. Time and again. Offense and defense forever on repeat. Even provable security, meant to provide an indubitable guarantee of security, does not stop attackers from finding security flaws. As we reflect on our achievements, we are left wondering: Can security be solved once and for all?
In this paper, we take a philosophical perspective and develop the first theory of cybersecurity that explains what fundamentally prevents us from making rel
arXiv
Empirical Analysis of Software Vulnerabilities Causing Timing Side Channels
arxiv_fulltext·2023-08-23
Empirical Analysis of Software Vulnerabilities Causing Timing Side Channels
Empirical Analysis of Software Vulnerabilities Causing Timing Side Channels
M. Mehdi Kholoosi12,
M. Ali Babar12,
Cemal Yilmaz3
1 School of Computer Science, CREST, The University of Adelaide, Adelaide, Australia
2 Cyber Security Cooperative Research Centre, Australia
3 Faculty of Engineering and Natural Sciences, Sabanci University, Istanbul, 34956, Turkey
Emails: [email protected], [email protected], [email protected]
## Abstract
Timing attacks are considered one of the most damaging side-channel attacks. These attacks exploit timing fluctuations caused by certain operations to disclose confidential information to an attacker. For instance, in asymmetric encryption, operations such as multiplication and division can cause time-varying execution times th
arXiv
Threat Assessment in Machine Learning based Systems
arxiv_fulltext·2022-06-30
Threat Assessment in Machine Learning based Systems
Threat Assessment in Machine Learning based Systems
Lionel Nganyewou Tidjon and Foutse Khomh, Senior Member, IEEE
The authors are with Polytechnique Montréal, Montréal, QC H3C 3A7, Canada.
E-mail: \lionel.tidjon, foutse.khomh\@polymtl.ca
## Abstract
Machine learning is a field of artificial intelligence (AI) that is becoming essential for several critical systems, making it a good target for threat actors. Threat actors exploit different Tactics, Techniques, and Procedures (TTPs) against the confidentiality, integrity, and availability of Machine Learning (ML) systems.
During the ML
cycle, they exploit adversarial TTPs to poison data and fool ML-based systems. In recent years, multiple security practices have been proposed for traditional systems but they are not enough to cope with th
arXiv
Evaluating the Performance of Twitter-based Exploit Detectors
arxiv_fulltext·2020-11-05
Evaluating the Performance of Twitter-based Exploit Detectors
Graygray0.9
g>Grayr
G>Grayc
## Abstract
Patch prioritization is a crucial aspect of information systems security, and knowledge of which vulnerabilities were exploited in the wild is a powerful tool to help systems administrators accomplish this task. The analysis of social media for this specific application can enhance the results and bring more agility by collecting data from online discussions and applying machine learning techniques to detect real-world exploits. In this paper, we use a technique that combines Twitter data with public database information to classify vulnerabilities as exploited or not-exploited. We analyze the behavior of different classifying algorithms, investigate the influence of different antivirus data as ground truth, and experiment with various time window
CWE
Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution
mitre_cwe
CWE-1423 Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution
CWE-1423: Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution
Shared microarchitectural predictor state may allow code to influence
transient execution across a hardware boundary, potentially exposing
data that is accessible beyond the boundary over a covert channel.
Many commodity processors have Instruction Set Architecture (ISA)
features that protect software components from one another. These
features can include memory segmentation, virtual memory, privilege
rings, trusted execution environments, and virtual machines, among
others. For example, virtual memory provides each process with its own
address space, which prevents processes from accessing each other's
private data. Many of these features can be used to fo
CWE
Processor Optimization Removal or Modification of Security-critical Code
mitre_cwe·CVSS 5.6
[MEDIUM] CWE-1037 Processor Optimization Removal or Modification of Security-critical Code
CWE-1037: Processor Optimization Removal or Modification of Security-critical Code
The developer builds a security-critical protection mechanism into the software, but the processor optimizes the execution of the program such that the mechanism is removed or modified.
Modes of Introduction:
Phase: Architecture and Design
Note: Optimizations built into the design of the processor can have unintended consequences during the execution of an application.
Common Consequences:
Scope: Integrity. Impact: Bypass Protection Mechanism. A successful exploitation of this weakness will change the order of an application's execution and will likely be used to bypass specific protection mechanisms. This bypass can be exploited further to potentially read data that should otherwise be unaccessible.
Det
CWE
Hardware Logic with Insecure De-Synchronization between Control and Data Channels
mitre_cwe
CWE-1264 Hardware Logic with Insecure De-Synchronization between Control and Data Channels
CWE-1264: Hardware Logic with Insecure De-Synchronization between Control and Data Channels
The hardware logic for error handling and security checks can incorrectly forward data before the security check is complete.
Many high-performance on-chip bus protocols and processor data-paths employ separate channels for control and data to increase parallelism and maximize throughput. Bugs in the hardware logic that handle errors and security checks can make it possible for data to be forwarded before the completion of the security checks. If the data can propagate to a location in the hardware observable to an attacker, loss of data confidentiality can occur. 'Meltdown' is a concrete example of how de-synchronization between data and permissions checking logic can violate confidentiality requ
http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2018-01/msg00008.htmlhttp://lists.opensuse.org/opensuse-security-announce/2018-01/msg00014.htmlhttp://lists.opensuse.org/opensuse-security-announce/2018-01/msg00016.htmlhttp://nvidia.custhelp.com/app/answers/detail/a_id/4609http://nvidia.custhelp.com/app/answers/detail/a_id/4611http://nvidia.custhelp.com/app/answers/detail/a_id/4613http://nvidia.custhelp.com/app/answers/detail/a_id/4614http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-001.txthttp://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-003.txthttp://www.kb.cert.org/vuls/id/584653http://www.securityfocus.com/bid/102378http://www.securityfocus.com/bid/106128http://www.securitytracker.com/id/1040071http://xenbits.xen.org/xsa/advisory-254.htmlhttps://access.redhat.com/errata/RHSA-2018:0292https://access.redhat.com/security/vulnerabilities/speculativeexecutionhttps://aws.amazon.com/de/security/security-bulletins/AWS-2018-013/https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/https://cdrdv2.intel.com/v1/dl/getContent/685358https://cert-portal.siemens.com/productcert/pdf/ssa-608355.pdfhttps://cert.vde.com/en-us/advisories/vde-2018-002https://cert.vde.com/en-us/advisories/vde-2018-003https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerabilityhttps://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.htmlhttps://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0https://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixeshttps://lists.debian.org/debian-lts-announce/2018/01/msg00004.htmlhttps://meltdownattack.com/https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180002https://security.FreeBSD.org/advisories/FreeBSD-SA-18:03.speculative_execution.aschttps://security.gentoo.org/glsa/201810-06https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.htmlhttps://security.netapp.com/advisory/ntap-20180104-0001/https://source.android.com/security/bulletin/2018-04-01https://support.citrix.com/article/CTX231399https://support.citrix.com/article/CTX234679https://support.f5.com/csp/article/K91229003https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03805en_ushttps://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03871en_ushttps://support.lenovo.com/us/en/solutions/LEN-18282https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180104-cpusidechannelhttps://usn.ubuntu.com/3522-3/https://usn.ubuntu.com/3522-4/https://usn.ubuntu.com/3523-1/https://usn.ubuntu.com/3540-2/https://usn.ubuntu.com/3541-2/https://usn.ubuntu.com/3583-1/https://usn.ubuntu.com/3597-1/https://usn.ubuntu.com/3597-2/https://usn.ubuntu.com/usn/usn-3516-1/https://usn.ubuntu.com/usn/usn-3522-2/https://usn.ubuntu.com/usn/usn-3523-2/https://usn.ubuntu.com/usn/usn-3524-2/https://usn.ubuntu.com/usn/usn-3525-1/https://www.codeaurora.org/security-bulletin/2018/07/02/july-2018-code-aurora-security-bulletinhttps://www.debian.org/security/2018/dsa-4078https://www.debian.org/security/2018/dsa-4082https://www.debian.org/security/2018/dsa-4120https://www.kb.cert.org/vuls/id/180049https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-18-0001https://www.oracle.com/security-alerts/cpuapr2020.htmlhttps://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlhttps://www.suse.com/c/suse-addresses-meltdown-spectre-vulnerabilities/https://www.synology.com/support/security/Synology_SA_18_01http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2018-01/msg00008.htmlhttp://lists.opensuse.org/opensuse-security-announce/2018-01/msg00014.htmlhttp://lists.opensuse.org/opensuse-security-announce/2018-01/msg00016.htmlhttp://nvidia.custhelp.com/app/answers/detail/a_id/4609http://nvidia.custhelp.com/app/answers/detail/a_id/4611http://nvidia.custhelp.com/app/answers/detail/a_id/4613http://nvidia.custhelp.com/app/answers/detail/a_id/4614http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-001.txthttp://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-003.txthttp://www.kb.cert.org/vuls/id/584653http://www.securityfocus.com/bid/102378http://www.securityfocus.com/bid/106128http://www.securitytracker.com/id/1040071http://xenbits.xen.org/xsa/advisory-254.htmlhttps://access.redhat.com/errata/RHSA-2018:0292https://access.redhat.com/security/vulnerabilities/speculativeexecutionhttps://aws.amazon.com/de/security/security-bulletins/AWS-2018-013/https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/https://cdrdv2.intel.com/v1/dl/getContent/685358https://cert-portal.siemens.com/productcert/pdf/ssa-608355.pdfhttps://cert.vde.com/en-us/advisories/vde-2018-002https://cert.vde.com/en-us/advisories/vde-2018-003https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerabilityhttps://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.htmlhttps://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0https://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixeshttps://lists.debian.org/debian-lts-announce/2018/01/msg00004.htmlhttps://meltdownattack.com/https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180002https://security.FreeBSD.org/advisories/FreeBSD-SA-18:03.speculative_execution.aschttps://security.gentoo.org/glsa/201810-06https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html
+ 32 more references
2018-01-04
Published