CVE-2018-15572
published 2018-08-20CVE-2018-15572: The spectre_v2_select_mitigation function in arch/x86/kernel/cpu/bugs.c in the Linux kernel before 4.18.1 does not always fill RSB upon a context switch, which…
PriorityP425medium6.5CVSS 3.0
AVLACLPRLUINSCCHINAN
EPSS
0.51%
40.8th percentile
The spectre_v2_select_mitigation function in arch/x86/kernel/cpu/bugs.c in the Linux kernel before 4.18.1 does not always fill RSB upon a context switch, which makes it easier for attackers to conduct userspace-userspace spectreRSB attacks.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | linux | < linux 4.17.15-1 (bookworm) | linux 4.17.15-1 (bookworm) |
| linux | linux_kernel | < 4.18.1 | 4.18.1 |
| linux | linux_kernel | >= 0 < 4.17.15-1 | 4.17.15-1 |
| linux | linux_kernel | >= 0 < 4.17.15-1 | 4.17.15-1 |
| linux | linux_kernel | >= 0 < 4.17.15-1 | 4.17.15-1 |
| linux | linux_kernel | >= 0 < 4.17.15-1 | 4.17.15-1 |
| linux | linux_kernel | >= 0 < 3.13.0-160.210 | 3.13.0-160.210 |
| linux | linux_kernel | >= 0 < 4.4.0-137.163 | 4.4.0-137.163 |
| linux | linux_kernel | >= 0 < 4.15.0-36.39 | 4.15.0-36.39 |
CVSS provenance
nvdv3.06.5MEDIUMCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
osv7.8HIGH
vendor_ubuntu7.0HIGH
vendor_debian6.5MEDIUM
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-fr39-wf38-f5w3: The spectre_v2_select_mitigation function in arch/x86/kernel/cpu/bugs
ghsa_unreviewed·2022-05-13
CVE-2018-15572 [MEDIUM] GHSA-fr39-wf38-f5w3: The spectre_v2_select_mitigation function in arch/x86/kernel/cpu/bugs
The spectre_v2_select_mitigation function in arch/x86/kernel/cpu/bugs.c in the Linux kernel before 4.18.1 does not always fill RSB upon a context switch, which makes it easier for attackers to conduct userspace-userspace spectreRSB attacks.
OSV
linux-azure vulnerabilities
osv·2018-10-23·CVSS 5.6
CVE-2018-17182 [MEDIUM] linux-azure vulnerabilities
linux-azure vulnerabilities
USN-3777-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04
%LTS. This update provides the corresponding updates for the
Linux kernel for Azure Cloud systems.
Jann Horn discovered that the vmacache subsystem did not properly handle
sequence number overflows, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or execute arbitrary code. (CVE-2018-17182)
It was discovered that the paravirtualization implementation in the Linux
kernel did not properly handle some indirect calls, reducing the
effectiveness of Spectre v2 mitigations for paravirtual guests. A local
attacker could use this to expose sensitive information. (CVE-2018-15594)
It was discovered that microprocessors utilizing sp
OSV
linux vulnerabilities
osv·2018-10-01·CVSS 7.0
CVE-2018-15594 [HIGH] linux vulnerabilities
linux vulnerabilities
It was discovered that the paravirtualization implementation in the Linux
kernel did not properly handle some indirect calls, reducing the
effectiveness of Spectre v2 mitigations for paravirtual guests. A local
attacker could use this to expose sensitive information. (CVE-2018-15594)
It was discovered that microprocessors utilizing speculative execution and
prediction of return addresses via Return Stack Buffer (RSB) may allow
unauthorized memory reads via sidechannel attacks. An attacker could use
this to expose sensitive information. (CVE-2018-15572)
It was discovered that an integer overflow vulnerability existed in the
Linux kernel when loading an executable to run. A local attacker could use
this to gain administrative privileges. (CVE-2018-14634)
It was disc
OSV
linux-hwe, linux-gcp vulnerabilities
osv·2018-10-01·CVSS 7.8
[HIGH] linux-hwe, linux-gcp vulnerabilities
linux-hwe, linux-gcp vulnerabilities
USN-3777-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu
16.04 LTS.
Jann Horn discovered that the vmacache subsystem did not properly handle
sequence number overflows, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or execute arbitrary code. (CVE-2018-17182)
It was discovered that the paravirtualization implementation in the Linux
kernel did not properly handle some indirect calls, reducing the
effectiveness of Spectre v2 mitigations for paravirtual guests. A local
attacker could use this to expose sensitive information. (CVE-2018-15594)
OSV
linux, linux-aws, linux-gcp, linux-kvm, linux-oem, linux-raspi2 vulnerabilities
osv·2018-10-01·CVSS 7.8
CVE-2018-17182 [HIGH] linux, linux-aws, linux-gcp, linux-kvm, linux-oem, linux-raspi2 vulnerabilities
linux, linux-aws, linux-gcp, linux-kvm, linux-oem, linux-raspi2 vulnerabilities
Jann Horn discovered that the vmacache subsystem did not properly handle
sequence number overflows, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or execute arbitrary code. (CVE-2018-17182)
It was discovered that the paravirtualization implementation in the Linux
kernel did not properly handle some indirect calls, reducing the
effectiveness of Spectre v2 mitigations for paravirtual guests. A local
attacker could use this to expose sensitive information. (CVE-2018-15594)
It was discovered that microprocessors utilizing speculative execution and
prediction of return addresses via Return Stack Buffer (RSB) may allow
unauthorized memory rea
OSV
linux-lts-xenial, linux-aws vulnerabilities
osv·2018-10-01·CVSS 5.5
[MEDIUM] linux-lts-xenial, linux-aws vulnerabilities
linux-lts-xenial, linux-aws vulnerabilities
USN-3776-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 LTS.
Jann Horn discovered that the vmacache subsystem did not properly handle
sequence number overflows, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or execute arbitrary code. (CVE-2018-17182)
It was discovered that the paravirtualization implementation in the Linux
kernel did not properly handle some indirect calls, reducing the
effectiveness of Spectre v2 mitigations for paravirtual guests. A local
attacker could use this to expose sensitive information. (CVE-2018
OSV
linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
osv·2018-10-01·CVSS 5.5
CVE-2018-17182 [MEDIUM] linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
Jann Horn discovered that the vmacache subsystem did not properly handle
sequence number overflows, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or execute arbitrary code. (CVE-2018-17182)
It was discovered that the paravirtualization implementation in the Linux
kernel did not properly handle some indirect calls, reducing the
effectiveness of Spectre v2 mitigations for paravirtual guests. A local
attacker could use this to expose sensitive information. (CVE-2018-15594)
It was discovered that microprocessors utilizing speculative execution and
prediction of return addresses via Return Stack Buffer (RSB) may allow
unauthorized memory reads v
OSV
CVE-2018-15572: The spectre_v2_select_mitigation function in arch/x86/kernel/cpu/bugs
osv·2018-08-20·CVSS 6.5
CVE-2018-15572 [MEDIUM] CVE-2018-15572: The spectre_v2_select_mitigation function in arch/x86/kernel/cpu/bugs
The spectre_v2_select_mitigation function in arch/x86/kernel/cpu/bugs.c in the Linux kernel before 4.18.1 does not always fill RSB upon a context switch, which makes it easier for attackers to conduct userspace-userspace spectreRSB attacks.
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2018-10-23·CVSS 5.6
CVE-2017-5715 [MEDIUM] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
USN-3777-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04
%LTS. This update provides the corresponding updates for the
Linux kernel for Azure Cloud systems.
Jann Horn discovered that the vmacache subsystem did not properly handle
sequence number overflows, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or execute arbitrary code. (CVE-2018-17182)
It was discovered that the paravirtualization implementation in the Linux
kernel did not properly handle some indirect calls, reducing the
effectiveness of Spectre v2 mitigations for paravirtual guests. A local
attacker could use this to expose sensitive
Ubuntu
Linux kernel (HWE) vulnerabilities
vendor_ubuntu·2018-10-01·CVSS 7.0
CVE-2018-10853 [HIGH] Linux kernel (HWE) vulnerabilities
Title: Linux kernel (HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
USN-3777-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu
16.04 LTS.
Jann Horn discovered that the vmacache subsystem did not properly handle
sequence number overflows, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or execute arbitrary code. (CVE-2018-17182)
It was discovered that the paravirtualization implementation in the Linux
kernel did not properly handle some indirect calls, reducing the
effectiveness of Spectre v2 mitigations for paravirtual guests. A local
at
Ubuntu
Linux kernel (Trusty HWE) vulnerabilities
vendor_ubuntu·2018-10-01·CVSS 7.0
CVE-2018-14633 [HIGH] Linux kernel (Trusty HWE) vulnerabilities
Title: Linux kernel (Trusty HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
USN-3775-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 14.04 LTS for Ubuntu
12.04 ESM.
It was discovered that the paravirtualization implementation in the Linux
kernel did not properly handle some indirect calls, reducing the
effectiveness of Spectre v2 mitigations for paravirtual guests. A local
attacker could use this to expose sensitive information. (CVE-2018-15594)
It was discovered that microprocessors utilizing speculative execution and
prediction of return addresses via Return Stack Buffer (RSB) may allow
unauthorized memory reads via sidechan
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2018-10-01·CVSS 5.5
CVE-2017-18216 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Jann Horn discovered that the vmacache subsystem did not properly handle
sequence number overflows, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or execute arbitrary code. (CVE-2018-17182)
It was discovered that the paravirtualization implementation in the Linux
kernel did not properly handle some indirect calls, reducing the
effectiveness of Spectre v2 mitigations for paravirtual guests. A local
attacker could use this to expose sensitive information. (CVE-2018-15594)
It was discovered that microprocessors utilizing speculative execution and
prediction of return addresses via Return Stack Buffer (RSB) may allow
u
Ubuntu
Linux kernel (Xenial HWE) vulnerabilities
vendor_ubuntu·2018-10-01·CVSS 5.5
CVE-2017-18216 [MEDIUM] Linux kernel (Xenial HWE) vulnerabilities
Title: Linux kernel (Xenial HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
USN-3776-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 LTS.
Jann Horn discovered that the vmacache subsystem did not properly handle
sequence number overflows, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or execute arbitrary code. (CVE-2018-17182)
It was discovered that the paravirtualization implementation in the Linux
kernel did not properly handle some indirect calls, reducing the
effectiveness of Spectre v2 mitigations for paravirtual guests. A l
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2018-10-01·CVSS 7.0
CVE-2018-10853 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Jann Horn discovered that the vmacache subsystem did not properly handle
sequence number overflows, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or execute arbitrary code. (CVE-2018-17182)
It was discovered that the paravirtualization implementation in the Linux
kernel did not properly handle some indirect calls, reducing the
effectiveness of Spectre v2 mitigations for paravirtual guests. A local
attacker could use this to expose sensitive information. (CVE-2018-15594)
It was discovered that microprocessors utilizing speculative execution and
prediction of return addresses via Return Stack Buffer (RSB) may allow
u
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2018-10-01·CVSS 7.0
CVE-2018-14633 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the paravirtualization implementation in the Linux
kernel did not properly handle some indirect calls, reducing the
effectiveness of Spectre v2 mitigations for paravirtual guests. A local
attacker could use this to expose sensitive information. (CVE-2018-15594)
It was discovered that microprocessors utilizing speculative execution and
prediction of return addresses via Return Stack Buffer (RSB) may allow
unauthorized memory reads via sidechannel attacks. An attacker could use
this to expose sensitive information. (CVE-2018-15572)
It was discovered that an integer overflow vulnerability existed in the
Linux kernel when loading an executable to run. A local attacker
Red Hat
Kernel: hw: cpu: userspace-userspace spectreRSB attack
vendor_redhat·2018-07-20·CVSS 6.5
CVE-2018-15572 [MEDIUM] CWE-1189 Kernel: hw: cpu: userspace-userspace spectreRSB attack
Kernel: hw: cpu: userspace-userspace spectreRSB attack
The spectre_v2_select_mitigation function in arch/x86/kernel/cpu/bugs.c in the Linux kernel before 4.18.1 does not always fill RSB upon a context switch, which makes it easier for attackers to conduct userspace-userspace spectreRSB attacks.
An issue was found in the way modern x86 microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimization) and prediction of return addresses via Return Stack Buffer (RSB). RSB is a small on chip structure that holds list of return addresses, used to predict function return addresses. An unprivileged attacker could use this flaw to cross the syscall or process boundary and read privileged memory by conducting targeted cache side-channel attack
Debian
CVE-2018-15572: linux - The spectre_v2_select_mitigation function in arch/x86/kernel/cpu/bugs.c in the L...
vendor_debian·2018·CVSS 6.5
CVE-2018-15572 [MEDIUM] CVE-2018-15572: linux - The spectre_v2_select_mitigation function in arch/x86/kernel/cpu/bugs.c in the L...
The spectre_v2_select_mitigation function in arch/x86/kernel/cpu/bugs.c in the Linux kernel before 4.18.1 does not always fill RSB upon a context switch, which makes it easier for attackers to conduct userspace-userspace spectreRSB attacks.
Scope: local
bookworm: resolved (fixed in 4.17.15-1)
bullseye: resolved (fixed in 4.17.15-1)
forky: resolved (fixed in 4.17.15-1)
sid: resolved (fixed in 4.17.15-1)
trixie: resolved (fixed in 4.17.15-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2018-15572 kernel: hw: cpu: userspace-userspace spectreRSB attack [fedora-all]
bugzilla·2018-08-15·CVSS 6.5
CVE-2018-15572 [MEDIUM] CVE-2018-15572 kernel: hw: cpu: userspace-userspace spectreRSB attack [fedora-all]
CVE-2018-15572 kernel: hw: cpu: userspace-userspace spectreRSB attack [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported ver
Bugzilla
CVE-2018-15572 Kernel: hw: cpu: userspace-userspace spectreRSB attack
bugzilla·2018-08-15·CVSS 6.5
CVE-2018-15572 [MEDIUM] CVE-2018-15572 Kernel: hw: cpu: userspace-userspace spectreRSB attack
CVE-2018-15572 Kernel: hw: cpu: userspace-userspace spectreRSB attack
An issue was found in the way modern x86 microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimisation) and prediction of return addresses via Return Stack Buffer(RSB). RSB is a small on chip structure that holds list of return addresses, used to predict function return addresses.
An unprivileged attacker could use this flaw to cross the syscall or process boundary and read privileged memory by conducting targeted cache side-channel attacks.
Upstream patch:
-> https://git.kernel.org/linus/fdf82a7856b32d905c39afc85e34364491e46346
References:
-> https://arxiv.org/pdf/1807.07940.pdf
-> https://christian-rossow.de/publications/ret2spec-ccs2018.pdf
Discussion:
Ac
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fdf82a7856b32d905c39afc85e34364491e46346https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.1https://github.com/torvalds/linux/commit/fdf82a7856b32d905c39afc85e34364491e46346https://lists.debian.org/debian-lts-announce/2018/10/msg00003.htmlhttps://usn.ubuntu.com/3775-1/https://usn.ubuntu.com/3775-2/https://usn.ubuntu.com/3776-1/https://usn.ubuntu.com/3776-2/https://usn.ubuntu.com/3777-1/https://usn.ubuntu.com/3777-2/https://usn.ubuntu.com/3777-3/https://www.debian.org/security/2018/dsa-4308http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fdf82a7856b32d905c39afc85e34364491e46346https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.1https://github.com/torvalds/linux/commit/fdf82a7856b32d905c39afc85e34364491e46346https://lists.debian.org/debian-lts-announce/2018/10/msg00003.htmlhttps://usn.ubuntu.com/3775-1/https://usn.ubuntu.com/3775-2/https://usn.ubuntu.com/3776-1/https://usn.ubuntu.com/3776-2/https://usn.ubuntu.com/3777-1/https://usn.ubuntu.com/3777-2/https://usn.ubuntu.com/3777-3/https://www.debian.org/security/2018/dsa-4308
2018-08-20
Published