CVE-2024-2201Native BHI: Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution in XEN

Severity
4.7MEDIUMNVD
OSV7.8OSV6.5
EPSS
0.0%
top 90.94%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 19

Description

A cross-privilege Spectre v2 vulnerability allows attackers to bypass all deployed mitigations, including the recent Fine(IBT), and to leak arbitrary Linux kernel memory on Intel systems.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.0 | Impact: 3.6

Affected Packages4 packages

Debianlinux/linux_kernel< 6.1.85-1+2
Ubuntulinux/linux_kernel< 5.4.0-187.207+3
Debianxen/xen< 4.17.5+23-ga4e5191dc0-1+2
CVEListV5xen/xenSee advisory "x86: Native Branch History Injection"

🔴Vulnerability Details

16
OSV
CVE-2024-2201: A cross-privilege Spectre v2 vulnerability allows attackers to bypass all deployed mitigations, including the recent Fine(IBT), and to leak arbitrary2024-12-19
GHSA
GHSA-j32h-9rm6-p2c5: A cross-privilege Spectre v2 vulnerability allows attackers to bypass all deployed mitigations, including the recent Fine(IBT), and to leak arbitrary2024-12-19
CVEList
CVE-2024-2201: A cross-privilege Spectre v2 vulnerability allows attackers to bypass all deployed mitigations, including the recent Fine(IBT), and to leak arbitrary2024-12-19
OSV
linux-aws-5.4 vulnerabilities2024-07-10
OSV
linux-azure vulnerabilities2024-07-10

📋Vendor Advisories

14
Ubuntu
Linux kernel (Azure) vulnerabilities2024-07-10
Ubuntu
Linux kernel (AWS) vulnerabilities2024-07-10
Ubuntu
Linux kernel (Azure) vulnerabilities2024-07-04
Ubuntu
Linux kernel vulnerabilities2024-07-03
Ubuntu
Linux kernel vulnerabilities2024-07-03

🕵️Threat Intelligence

4
Bleepingcomputer
New Spectre v2 attack impacts Linux systems on Intel CPUs2024-04-10
Trendmicro
The April 2024 Security Updates Review2024-04-09
Bleepingcomputer
Microsoft April 2024 Patch Tuesday fixes 150 security flaws, 67 RCEs2024-04-09
Trendmicro
The April 2024 Security Updates Review2024-04-09

💬Community

1
Bugzilla
CVE-2024-2201 hw: cpu: intel: Native Branch History Injection (BHI)2024-03-06