cnvd-2018-00304
Vulnerability from cnvd
Title
CPU处理器内核存在Meltdown漏洞（CNVD-2018-00304）
Description
CPU hardware是一套运行在CPU（中央处理器）中用于管理和控制CPU的固件。 CPU处理器内核存在Meltdown漏洞，该漏洞“熔化”了由硬件来实现的安全边界，允许低权限用户级别的应用程序“越界”访问系统级的内存，从而造成数据泄露。
Severity
中
Formal description

目前部分厂商发布了补丁修复信息： Amazon AWS：https://aws.amazon.com/security/security-bulletins/AWS-2018-013/ Apple：https://source.android.com/security/bulletin/2018-01-01 Android：https：//source.android.com/security/bulletin/2018-01-01

Reference
https://www.bleepingcomputer.com/news/security/list-of-meltdown-and-spectre-vulnerability-advisories-patches-and-updates/ https://www.securityfocus.com/bid/102371
Impacted products
Name
['Microsoft Windows 7 SP1', 'Microsoft Internet Explorer 11', 'Microsoft Windows 8.1', 'google V8', 'Microsoft Windows 10', 'Microsoft Edge', 'Intel Xeon CPU E5-1650 v3', 'ARM Cortex A57', 'AMD PRO A8-9600 R7', 'AMD 10 COMPUTE CORES 4C+6G', 'AMD FX(tm)-8320 Eight-Core Processor', 'Microsoft Windows Server']
Show details on source website

To clipboard 

{
  "bids": {
    "bid": {
      "bidNumber": "102371"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-5753"
    }
  },
  "description": "CPU hardware\u662f\u4e00\u5957\u8fd0\u884c\u5728CPU\uff08\u4e2d\u592e\u5904\u7406\u5668\uff09\u4e2d\u7528\u4e8e\u7ba1\u7406\u548c\u63a7\u5236CPU\u7684\u56fa\u4ef6\u3002 \r\n\r\nCPU\u5904\u7406\u5668\u5185\u6838\u5b58\u5728Meltdown\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u201c\u7194\u5316\u201d\u4e86\u7531\u786c\u4ef6\u6765\u5b9e\u73b0\u7684\u5b89\u5168\u8fb9\u754c\uff0c\u5141\u8bb8\u4f4e\u6743\u9650\u7528\u6237\u7ea7\u522b\u7684\u5e94\u7528\u7a0b\u5e8f\u201c\u8d8a\u754c\u201d\u8bbf\u95ee\u7cfb\u7edf\u7ea7\u7684\u5185\u5b58\uff0c\u4ece\u800c\u9020\u6210\u6570\u636e\u6cc4\u9732\u3002",
  "discovererName": "Jann Horn (Google Project Zero) and Paul Kocher in collaboration with, in alphabetical order, Daniel Genkin (University of Pennsylvania and University of Maryland), Mike Hamburg (Rambus), Moritz Lipp (Graz University of Technology), and Yuval Yarom (Univer",
  "formalWay": "\u76ee\u524d\u90e8\u5206\u5382\u5546\u53d1\u5e03\u4e86\u8865\u4e01\u4fee\u590d\u4fe1\u606f\uff1a\r\nAmazon AWS\uff1ahttps://aws.amazon.com/security/security-bulletins/AWS-2018-013/\r\nApple\uff1ahttps://source.android.com/security/bulletin/2018-01-01\r\nAndroid\uff1ahttps\uff1a//source.android.com/security/bulletin/2018-01-01",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-00304",
  "openTime": "2018-01-04",
  "products": {
    "product": [
      "Microsoft Windows 7 SP1",
      "Microsoft Internet Explorer 11",
      "Microsoft Windows 8.1",
      "google V8",
      "Microsoft Windows 10",
      "Microsoft Edge",
      "Intel Xeon CPU E5-1650 v3",
      "ARM Cortex A57",
      "AMD PRO A8-9600 R7",
      "AMD 10 COMPUTE CORES 4C+6G",
      "AMD FX(tm)-8320 Eight-Core Processor",
      "Microsoft Windows Server"
    ]
  },
  "referenceLink": "https://www.bleepingcomputer.com/news/security/list-of-meltdown-and-spectre-vulnerability-advisories-patches-and-updates/\r\nhttps://www.securityfocus.com/bid/102371",
  "serverity": "\u4e2d",
  "submitTime": "2018-01-04",
  "title": "CPU\u5904\u7406\u5668\u5185\u6838\u5b58\u5728Meltdown\u6f0f\u6d1e\uff08CNVD-2018-00304\uff09"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.