Intel CPU Speculative Execution Side-channel Vulnerability
A security vulnerability has been identified in Intel CPUs, that could result in potential improper infer of data values from multiple types of computing devices. Major infrastructure vendors, including VMWare, Cisco, Microsoft are assessing this vulnerability and updating their respective knowledge bases.
The vulnerability is registered as:
- CVE-2018-3646 (L1 Terminal Fault - VMM)
- CVE-2018-3620 (L1 Terminal Fault - OS)
- CVE-2018-3615 (L1 Terminal Fault – SGX, SMM)
How does this affect my organisation?
Customers of AC3’s public cloud should be aware that this may allow sensitive data to be accessed by other virtual machines running on the same hypervisor.
Customers of AC3’s private cloud services may also be impacted by this vulnerability but are only vulnerable to their own organisations virtual machines.
In addition to this, customer virtual machines are also vulnerable to these attacks. Processes may be able to access memory allocated to other processes regardless of the security protections put in place by the operating system.
Threat response rating
Based on information available at the time of this notice, AC3 have classified this threat as Warning and recommend that customers Watch and Act.
Advice—no urgent remediation action required
Warning—watch and act
Action required—urgent remediation action required
What actions should I take?
For customers of AC3’s public and private cloud services, AC3 will apply the relevant hypervisor patches as soon as they have been made available.
For customers that subscribe to AC3’s virtual machine management product, an AC3 representative will be in touch to schedule patching of these services.
More information
More information about this security vulnerability is available at the links below.
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3646
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00161.html
https://kb.vmware.com/s/article/55636
https://support.microsoft.com/en-au/help/4343909/windows-10-update-kb4343909