CVE-2018-3620

Published: 14 August 2018

Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access via a terminal page fault and a side-channel analysis.

From the Ubuntu security team

It was discovered that memory present in the L1 data cache of an Intel CPU core may be exposed to a malicious process that is executing on the CPU core. This vulnerability is also known as L1 Terminal Fault (L1TF). A local attacker could use this to expose sensitive information (memory from the kernel or other processes).

Priority

High

CVSS 3 base score: 5.6

Status

Notes

The break-fix lines for this CVE are not complete since a large
number of patches are required to mitigate this issue. The commit(s) listed
are chosen as placeholders for automated CVE triage purposes.

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3620
• https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/L1TF
• https://ubuntu.com/security/notices/USN-3740-1
• https://ubuntu.com/security/notices/USN-3740-2
• https://ubuntu.com/security/notices/USN-3741-1
• https://ubuntu.com/security/notices/USN-3741-2
• https://ubuntu.com/security/notices/USN-3742-1
• https://ubuntu.com/security/notices/USN-3742-2
• https://ubuntu.com/security/notices/USN-3823-1
• NVD
• Launchpad
• Debian

Bugs