Bug 1585005 (CVE-2018-3620, CVE-2018-3646) - CVE-2018-3620 CVE-2018-3646 Kernel: hw: cpu: L1 terminal fault (L1TF)
Summary: CVE-2018-3620 CVE-2018-3646 Kernel: hw: cpu: L1 terminal fault (L1TF)
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2018-3620, CVE-2018-3646
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1593373 1593374 1593375 1593376 1593377 1593378 1593379 1593380 1593381 1593382 1593383 1593384 1593385 1593386 1593387 1593388 1593389 1593390 1615998 1616046
Blocks: 1581205 1593291 1593292 1593293 1593294
TreeView+ depends on / blocked
 
Reported: 2018-06-01 06:40 UTC by Prasad Pandit
Modified: 2021-12-10 16:17 UTC (History)
66 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Modern operating systems implement virtualization of physical memory to efficiently use available system resources and provide inter-domain protection through access control and isolation. The L1TF issue was found in the way the x86 microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimization) in combination with handling of page-faults caused by terminated virtual to physical address resolving process. As a result, an unprivileged attacker could use this flaw to read privileged memory of the kernel or other processes and/or cross guest/host boundaries to read host memory by conducting targeted cache side-channel attacks.
Clone Of:
Environment:
Last Closed: 2018-09-07 07:24:56 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:2384 0 None None None 2018-08-14 18:45:26 UTC
Red Hat Product Errata RHSA-2018:2387 0 None None None 2018-08-14 20:15:44 UTC
Red Hat Product Errata RHSA-2018:2388 0 None None None 2018-08-14 20:06:53 UTC
Red Hat Product Errata RHSA-2018:2389 0 None None None 2018-08-14 20:23:21 UTC
Red Hat Product Errata RHSA-2018:2390 0 None None None 2018-08-14 18:26:30 UTC
Red Hat Product Errata RHSA-2018:2391 0 None None None 2018-08-14 20:31:54 UTC
Red Hat Product Errata RHSA-2018:2392 0 None None None 2018-08-14 20:17:06 UTC
Red Hat Product Errata RHSA-2018:2393 0 None None None 2018-08-14 20:20:24 UTC
Red Hat Product Errata RHSA-2018:2394 0 None None None 2018-08-14 20:19:45 UTC
Red Hat Product Errata RHSA-2018:2395 0 None None None 2018-08-14 20:24:51 UTC
Red Hat Product Errata RHSA-2018:2396 0 None None None 2018-08-14 20:18:22 UTC
Red Hat Product Errata RHSA-2018:2402 0 None None None 2018-08-16 05:21:16 UTC
Red Hat Product Errata RHSA-2018:2403 0 None None None 2018-08-15 10:20:43 UTC
Red Hat Product Errata RHSA-2018:2404 0 None None None 2018-08-15 15:25:22 UTC
Red Hat Product Errata RHSA-2018:2602 0 None None None 2018-08-29 18:29:12 UTC
Red Hat Product Errata RHSA-2018:2603 0 None None None 2018-08-29 18:29:55 UTC

Description Prasad Pandit 2018-06-01 06:40:12 UTC 
Modern operating systems implement virtualization of physical memory to efficiently use available system resources and provide inter-domain protection through access control and isolation.

The L1TF issue was found in the way the x86 microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimisation) in combination with handling of page-faults caused by terminated virtual to physical address resolving process.

As a result, an unprivileged attacker could use this flaw to read privileged
memory of the kernel or other processes and/or cross guest/host boundaries to read host memory by conducting targeted cache side-channel attacks.

CVE-2018-3620: for attack vector against the operating system (Kernel)
CVE-2018-3646: for attack vector against virtualization hypervisor (KVM)

Upstream patches:
-----------------
  -> https://git.kernel.org/linus/958f338e96f874a0d29442396d6adf9c1e17aa2d
Comment 3 Prasad Pandit 2018-06-27 13:08:12 UTC 
Statement:

This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2 may address this issue.
Comment 4 Prasad Pandit 2018-07-24 18:29:43 UTC 
Acknowledgments:

Name: Intel OSSIRT (Intel.com)
Comment 5 Prasad Pandit 2018-07-31 10:03:12 UTC 
External References:

https://access.redhat.com/security/vulnerabilities/L1TF
https://www.redhat.com/en/blog/understanding-l1-terminal-fault-aka-foreshadow-what-you-need-know
https://www.redhat.com/en/blog/deeper-look-l1-terminal-fault-aka-foreshadow
https://foreshadowattack.eu/
https://software.intel.com/security-software-guidance/software-guidance/l1-terminal-fault
https://access.redhat.com/articles/3562741
Comment 7 Prasad Pandit 2018-08-14 17:04:22 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1615998]
Comment 8 errata-xmlrpc 2018-08-14 18:26:05 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2018:2390 https://access.redhat.com/errata/RHSA-2018:2390
Comment 9 errata-xmlrpc 2018-08-14 18:44:59 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:2384 https://access.redhat.com/errata/RHSA-2018:2384
Comment 11 errata-xmlrpc 2018-08-14 20:06:29 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.3 Extended Update Support

Via RHSA-2018:2388 https://access.redhat.com/errata/RHSA-2018:2388
Comment 12 errata-xmlrpc 2018-08-14 20:15:17 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.4 Extended Update Support

Via RHSA-2018:2387 https://access.redhat.com/errata/RHSA-2018:2387
Comment 13 errata-xmlrpc 2018-08-14 20:16:39 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6.6 Advanced Update Support
  Red Hat Enterprise Linux 6.6 Telco Extended Update Support

Via RHSA-2018:2392 https://access.redhat.com/errata/RHSA-2018:2392
Comment 14 errata-xmlrpc 2018-08-14 20:18:01 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise MRG 2

Via RHSA-2018:2396 https://access.redhat.com/errata/RHSA-2018:2396
Comment 15 errata-xmlrpc 2018-08-14 20:19:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6.4 Advanced Update Support

Via RHSA-2018:2394 https://access.redhat.com/errata/RHSA-2018:2394
Comment 16 errata-xmlrpc 2018-08-14 20:20:00 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6.5 Advanced Update Support

Via RHSA-2018:2393 https://access.redhat.com/errata/RHSA-2018:2393
Comment 17 errata-xmlrpc 2018-08-14 20:22:58 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.2 Advanced Update Support
  Red Hat Enterprise Linux 7.2 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.2 Telco Extended Update Support

Via RHSA-2018:2389 https://access.redhat.com/errata/RHSA-2018:2389
Comment 18 errata-xmlrpc 2018-08-14 20:24:28 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:2395 https://access.redhat.com/errata/RHSA-2018:2395
Comment 19 errata-xmlrpc 2018-08-14 20:31:21 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6.7 Extended Update Support

Via RHSA-2018:2391 https://access.redhat.com/errata/RHSA-2018:2391
Comment 20 errata-xmlrpc 2018-08-15 10:20:15 UTC 
This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 7

Via RHSA-2018:2403 https://access.redhat.com/errata/RHSA-2018:2403
Comment 21 errata-xmlrpc 2018-08-15 15:24:56 UTC 
This issue has been addressed in the following products:

  RHEV 3.X Hypervisor and Agents for RHEL-6
  RHEV 3.X Hypervisor and Agents for RHEL-7 ELS

Via RHSA-2018:2404 https://access.redhat.com/errata/RHSA-2018:2404
Comment 22 errata-xmlrpc 2018-08-16 05:20:48 UTC 
This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 7

Via RHSA-2018:2402 https://access.redhat.com/errata/RHSA-2018:2402
Comment 23 errata-xmlrpc 2018-08-29 18:28:49 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 5 Extended Lifecycle Support

Via RHSA-2018:2602 https://access.redhat.com/errata/RHSA-2018:2602
Comment 24 errata-xmlrpc 2018-08-29 18:29:33 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 5.9 Long Life

Via RHSA-2018:2603 https://access.redhat.com/errata/RHSA-2018:2603
Note You need to log in before you can comment on or make changes to this bug.