cnvd-2018-00303
Vulnerability from cnvd

Title: CPU处理器内核存在Spectre漏洞

Description:

CPU hardware是一套运行在CPU（中央处理器）中用于管理和控制CPU的固件。

CPU处理器内核存在Spectre漏洞，由于Intel未将低权限的应用程序与访问内核内存分开，导致攻击者可以使用恶意应用程序来获取应该被隔离的私有数据。

Severity: 中

Formal description:

目前部分厂商发布了补丁修复信息： Amazon AWS：https://aws.amazon.com/security/security-bulletins/AWS-2018-013/ Apple：https://source.android.com/security/bulletin/2018-01-01 Android：https：//source.android.com/security/bulletin/2018-01-01

Reference: https://www.bleepingcomputer.com/news/security/list-of-meltdown-and-spectre-vulnerability-advisories-patches-and-updates/ https://www.securityfocus.com/bid/102378

Impacted products
Name
['Red Hat Enterprise Linux Desktop 6', 'Microsoft Windows Server 2008 R2', 'Microsoft Windows 7 for 32-bit Systems SP1', 'Microsoft Windows 7 for x64-based Systems SP1', 'Red Hat Enterprise Linux 6', 'Red Hat Enterprise Linux Workstation 6', 'Red Hat Enterprise Linux Server 6', 'Microsoft Windows Windows Server 2012', 'Microsoft Windows 8.1', 'google V8', 'Microsoft Windows Server 2012 R2', 'Microsoft Edge', 'Microsoft Internet Explorer 11', 'Microsoft Windows Server 2016', 'Microsoft Windows 8.1 for x64-based Systems 0', 'Microsoft Windows 8.1 for 32-bit Systems 0', 'Microsoft Windows 10 version 1511 for x64-based Systems 0', 'Microsoft Windows 10 version 1511 for 32-bit Systems 0', 'Microsoft Windows 10 for 32-bit Systems', 'Microsoft Windows 10 for x64-based Systems', 'Microsoft Windows 10 Version 1511 for 32-bit Systems', 'Microsoft Windows 10 Version 1511 for x64-based Systems', 'Microsoft Windows 10 Version 1607 for 32-bit Systems', 'Microsoft Windows 10 Version 1607 for x64-based Systems', 'Microsoft Windows 10 Version 1703 for 32-bit Systems', 'Microsoft Windows 10 Version 1703 for x64-based Systems', 'Red Hat Enterprise Linux Workstation 7', 'Red Hat Enterprise Linux Server 7', 'Red Hat Enterprise Linux Desktop 7', 'VMware ESXi 5.5', 'Apple tvOS <11.2', 'Apple IOS <11.2', 'Intel Xeon CPU E5-1650 v3', 'VMWare Workstation 12.5.7', 'VMWare Workstation 12.5.5', 'VMWare Workstation 12.5.3', 'VMWare Workstation 12.0', 'VMWare Fusion 8.5.8', 'VMWare Fusion 8.5.6', 'VMWare Fusion 8.5.4', 'VMWare Fusion 8.5.2', 'VMWare Fusion 8.1.1', 'VMWare Fusion 8.1', 'VMWare Fusion 8.0.2', 'VMWare Fusion 8.0.1', 'VMWare Fusion 8.5.5', 'VMWare Fusion 8.5', 'VMWare Fusion 8.0', 'VMWare ESXi 6.5', 'VMWare ESXi 6.0', 'Red Hat Enterprise Linux Server TUS 7.4', 'Red Hat Enterprise Linux Server TUS 7.2', 'Red Hat Enterprise Linux Server TUS 6.6', 'Red Hat Enterprise Linux Server AUS 7.4', 'Red Hat Enterprise Linux Server AUS 7.2', 'Red Hat Enterprise Linux Server AUS 7.3', 'Red Hat Enterprise Linux Server AUS 6.6', 'Apple MacOS <10.13.2', 'Cisco Cloud Services Platform (CSP) 2100', 'Cisco vBond Orchestrator', 'Cisco vEdge Cloud', 'Cisco vEdge 5000', 'Cisco vEdge 2000', 'Cisco vEdge 100', 'Cisco vEdge 1000']
Show details on source website

To clipboard 

{
  "bids": {
    "bid": {
      "bidNumber": "102378"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-5754"
    }
  },
  "description": "CPU hardware\u662f\u4e00\u5957\u8fd0\u884c\u5728CPU\uff08\u4e2d\u592e\u5904\u7406\u5668\uff09\u4e2d\u7528\u4e8e\u7ba1\u7406\u548c\u63a7\u5236CPU\u7684\u56fa\u4ef6\u3002 \r\n\r\nCPU\u5904\u7406\u5668\u5185\u6838\u5b58\u5728Spectre\u6f0f\u6d1e\uff0c\u7531\u4e8eIntel\u672a\u5c06\u4f4e\u6743\u9650\u7684\u5e94\u7528\u7a0b\u5e8f\u4e0e\u8bbf\u95ee\u5185\u6838\u5185\u5b58\u5206\u5f00\uff0c\u5bfc\u81f4\u653b\u51fb\u8005\u53ef\u4ee5\u4f7f\u7528\u6076\u610f\u5e94\u7528\u7a0b\u5e8f\u6765\u83b7\u53d6\u5e94\u8be5\u88ab\u9694\u79bb\u7684\u79c1\u6709\u6570\u636e\u3002",
  "discovererName": "Jann Horn (Google Project Zero), Werner Haas, Thomas Prescher (Cyberus Technology), Daniel Gruss, Moritz Lipp, Stefan Mangard, Michael Schwarz (Graz University of Technology)",
  "formalWay": "\u76ee\u524d\u90e8\u5206\u5382\u5546\u53d1\u5e03\u4e86\u8865\u4e01\u4fee\u590d\u4fe1\u606f\uff1a\r\nAmazon AWS\uff1ahttps://aws.amazon.com/security/security-bulletins/AWS-2018-013/\r\nApple\uff1ahttps://source.android.com/security/bulletin/2018-01-01\r\nAndroid\uff1ahttps\uff1a//source.android.com/security/bulletin/2018-01-01",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-00303",
  "openTime": "2018-01-04",
  "products": {
    "product": [
      "Red Hat Enterprise Linux Desktop 6",
      "Microsoft Windows Server 2008 R2",
      "Microsoft Windows 7 for 32-bit Systems SP1",
      "Microsoft Windows 7 for x64-based Systems SP1",
      "Red Hat Enterprise Linux   6",
      "Red Hat Enterprise Linux Workstation 6",
      "Red Hat Enterprise Linux Server 6",
      "Microsoft Windows Windows Server 2012",
      "Microsoft Windows 8.1",
      "google V8",
      "Microsoft Windows Server 2012 R2",
      "Microsoft Edge",
      "Microsoft Internet Explorer  11",
      "Microsoft Windows Server 2016",
      "Microsoft Windows 8.1 for x64-based Systems 0",
      "Microsoft Windows 8.1 for 32-bit Systems 0",
      "Microsoft Windows 10 version 1511 for x64-based Systems 0",
      "Microsoft Windows 10 version 1511 for 32-bit Systems 0",
      "Microsoft Windows 10 for 32-bit Systems",
      "Microsoft Windows 10 for x64-based Systems",
      "Microsoft Windows 10 Version 1511 for 32-bit Systems",
      "Microsoft Windows 10 Version 1511 for x64-based Systems",
      "Microsoft Windows 10 Version 1607 for 32-bit Systems",
      "Microsoft Windows 10 Version 1607 for x64-based Systems",
      "Microsoft Windows 10 Version 1703 for 32-bit Systems",
      "Microsoft Windows 10 Version 1703 for x64-based Systems",
      "Red Hat Enterprise Linux Workstation 7",
      "Red Hat Enterprise Linux Server 7",
      "Red Hat Enterprise Linux Desktop 7",
      "VMware ESXi 5.5",
      "Apple tvOS \u003c11.2",
      "Apple IOS \u003c11.2",
      "Intel Xeon CPU E5-1650 v3",
      "VMWare Workstation 12.5.7",
      "VMWare Workstation 12.5.5",
      "VMWare Workstation 12.5.3",
      "VMWare Workstation 12.0",
      "VMWare Fusion 8.5.8",
      "VMWare Fusion 8.5.6",
      "VMWare Fusion 8.5.4",
      "VMWare Fusion 8.5.2",
      "VMWare Fusion 8.1.1",
      "VMWare Fusion 8.1",
      "VMWare Fusion 8.0.2",
      "VMWare Fusion 8.0.1",
      "VMWare Fusion 8.5.5",
      "VMWare Fusion 8.5",
      "VMWare Fusion 8.0",
      "VMWare ESXi 6.5",
      "VMWare ESXi 6.0",
      "Red Hat Enterprise Linux Server TUS 7.4",
      "Red Hat Enterprise Linux Server TUS 7.2",
      "Red Hat Enterprise Linux Server TUS 6.6",
      "Red Hat Enterprise Linux Server AUS 7.4",
      "Red Hat Enterprise Linux Server AUS 7.2",
      "Red Hat Enterprise Linux Server AUS 7.3",
      "Red Hat Enterprise Linux Server AUS 6.6",
      "Apple MacOS \u003c10.13.2",
      "Cisco Cloud Services Platform (CSP) 2100",
      "Cisco vBond Orchestrator",
      "Cisco vEdge Cloud",
      "Cisco vEdge 5000",
      "Cisco vEdge 2000",
      "Cisco vEdge 100",
      "Cisco vEdge 1000"
    ]
  },
  "referenceLink": "https://www.bleepingcomputer.com/news/security/list-of-meltdown-and-spectre-vulnerability-advisories-patches-and-updates/\r\nhttps://www.securityfocus.com/bid/102378",
  "serverity": "\u4e2d",
  "submitTime": "2018-01-04",
  "title": "CPU\u5904\u7406\u5668\u5185\u6838\u5b58\u5728Spectre\u6f0f\u6d1e"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.