PT-2018-1444 · Intel+2 · Intel Sgx+2

Baris Kasikci + 9 · Published 2018-01-03 · Updated 2020-08-24 · CVE-2018-3615

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Intel SGX (affected versions not specified) Huawei VRP (affected versions not specified)

Description The issue is related to the implementation of Intel Software Guard Extensions (SGX) technology and speculative execution in microprocessors. It may allow unauthorized disclosure of information from an enclave to an attacker with local user access via a side-channel analysis. This can enable an attacker to read data from the L1 cache, which may contain fragments of data from the protected area after speculative execution.

Recommendations For Intel SGX, consider disabling speculative execution as a temporary workaround until a patch is available. For Huawei VRP, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Side Channel Attack

Weakness Enumeration

CWE-203

CWE-524

Related Identifiers

ALT-PU-2018-2253

BDU:2018-00994

CVE-2018-3615

DLA-1506-1

MGASA-2018-0344

MGASA-2018-0345

MGASA-2018-0346

MGASA-2018-0347

Affected Products

Alt Linux

Huawei Vrp

Intel Sgx

References · 45

• 🔥 https://foreshadowattack.eu/foreshadow.pdf · Exploit
• https://osv.dev/vulnerability/MGASA-2018-0346 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00994 · Security Note
• https://advisories.mageia.org/MGASA-2018-0345.html · Security Note
• https://ubuntu.com/security/CVE-2018-3615 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1506-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0347.html · Security Note
• https://osv.dev/vulnerability/MGASA-2018-0344 · Vendor Advisory
• https://software.intel.com/security-software-guidance/software-guidance/l1-terminal-fault · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-3615 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-3615 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0347 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-3615 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0346.html · Security Note
• https://advisories.mageia.org/MGASA-2018-0344.html · Security Note