Russian Vulnerability Scanner Database

Back to List

BDU:2018-00002

Scores

EPSS

0.000none0.0%
0%20%40%60%80%100%

Percentile: 0.0%

CVSS

5.6medium3.x
0246810

CVSS Score: 5.6/10

All CVSS Scores

CVSS 3.x
5.6

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

CVSS 2.0
4.4

Vector: AV:L/AC:M/Au:S/C:C/I:N/A:N

Description

Уязвимость процессоров Intel, ARM и AMD связана с особенностями функционирования модуля прогнозирования ветвлений. Эксплуатация уязвимости позволяет нарушителю получить доступ к защищенной памяти из программы, не обладающей соответствующими привилегиями, путём создания условий неправильного предсказания ветвей выполнения

Scaner-VS 7 — a modern vulnerability management solution

Uses this database for vulnerability detection. High-speed search, cross-platform, advanced configuration audit, and flexible filtering. Suitable for organizations of any size.
Learn more about Scaner-VS 7

Sources

bdu

Related Vulnerabilities

CVE-2017-5753

Exploits

Exploit ID: 43427

Source: exploitdb

URL: https://www.exploit-db.com/exploits/43427

Exploit ID: CVE-2017-5753

Source: github-poc

URL: https://github.com/sachinthaBS/Spectre-Vulnerability-CVE-2017-5753-

Reference Links

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-5753
http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00006.html
http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html
http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00008.html
http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00014.html
http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00016.html
http://nvidia.custhelp.com/app/answers/detail/a_id/4609
http://nvidia.custhelp.com/app/answers/detail/a_id/4611
http://nvidia.custhelp.com/app/answers/detail/a_id/4613
http://nvidia.custhelp.com/app/answers/detail/a_id/4614
http://packetstormsecurity.com/files/145645/Spectre-Information-Disclosure-Proof-Of-Concept.html
http://www.amd.com/en/corporate/speculative-execution
http://www.kb.cert.org/vuls/id/584653
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
http://www.securityfocus.com/bid/102371
http://www.securitytracker.com/id/1040071
http://xenbits.xen.org/xsa/advisory-254.html
https://01.org/security/advisories/intel-oss-10002
https://access.redhat.com/security/vulnerabilities/speculativeexecution
https://aws.amazon.com/de/security/security-bulletins/AWS-2018-013/
https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/
https://bugs.launchpad.net/ubuntu/+source/nvidia-graphics-drivers-384/+bug/1741807
https://cert-portal.siemens.com/productcert/pdf/ssa-505225.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5753
https://developer.arm.com/support/security-update
https://googleprojectzero.blogspot.co.uk/2018/01/reading-privileged-memory-with-side.html
https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html
https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.27
https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.15.10
https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.127
https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.88
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180002
https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html
https://security.netapp.com/advisory/ntap-20180104-0001/
https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00088&languageid=en-fr
https://spectreattack.com/
https://strelets.net/patchi-i-obnovleniya-bezopasnosti#16012023
https://support.citrix.com/article/CTX231399
https://support.f5.com/csp/article/K91229003
https://support.lenovo.com/us/en/solutions/LEN-18282
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180104-cpusidechannel
https://ubuntu.com/security/notices/USN-3516-1
https://ubuntu.com/security/notices/USN-3521-1
https://ubuntu.com/security/notices/USN-3530-1
https://ubuntu.com/security/notices/USN-3540-1
https://ubuntu.com/security/notices/USN-3540-2
https://ubuntu.com/security/notices/USN-3541-1
https://ubuntu.com/security/notices/USN-3541-2
https://ubuntu.com/security/notices/USN-3542-1
https://ubuntu.com/security/notices/USN-3542-2
https://ubuntu.com/security/notices/USN-3549-1
https://ubuntu.com/security/notices/USN-3580-1
https://ubuntu.com/security/notices/USN-3597-1
https://ubuntu.com/security/notices/USN-3597-2
https://usn.ubuntu.com/usn/usn-3516-1
https://usn.ubuntu.com/usn/usn-3521-1
https://usn.ubuntu.com/usn/usn-3530-1
https://usn.ubuntu.com/usn/usn-3540-1
https://usn.ubuntu.com/usn/usn-3540-2
https://usn.ubuntu.com/usn/usn-3541-1
https://usn.ubuntu.com/usn/usn-3541-2
https://usn.ubuntu.com/usn/usn-3542-1
https://usn.ubuntu.com/usn/usn-3542-2
https://usn.ubuntu.com/usn/usn-3549-1
https://usn.ubuntu.com/usn/usn-3580-1
https://usn.ubuntu.com/usn/usn-3597-1
https://usn.ubuntu.com/usn/usn-3597-2
https://webkit.org/blog/8048/what-spectre-and-meltdown-mean-for-webkit/
https://webkitgtk.org/security/WSA-2018-0001.html
https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAndMeltdown
https://www.cve.org/CVERecord?id=CVE-2017-5753
https://www.exploit-db.com/exploits/43427/
https://www.suse.com/c/suse-addresses-meltdown-spectre-vulnerabilities/
https://www.synology.com/support/security/Synology_SA_18_01
https://www.vmware.com/us/security/advisories/VMSA-2018-0002.html
https://wiki.astralinux.ru/pages/viewpage.action?pageId=1212483
https://wiki.astralinux.ru/pages/viewpage.action?pageId=44892734

Recommendations

Source: bdu

Возможны следующие меры по устранению уязвимости:
-вариант 1: на аппаратном уровне;
-вариант 2: на системном уровне;
-вариант 3: на прикладном уровне.
Первый вариант предполагает замену процессора, однако данный вариант трудно реализуем на практике.
Наиболее актуален второй вариант, предполагающий установку обновления, выпущенного разработчиками системного программного обеспечения.
Третий вариант применим к браузерам и возможен лишь для противодействия векторам атак, связанных с использованием JavaScript.
Подробные рекомендации по устранению представлены на сайтах разработчиков программного обеспечения:
http://nvidia.custhelp.com/app/answers/detail/a_id/4609
http://nvidia.custhelp.com/app/answers/detail/a_id/4611
http://nvidia.custhelp.com/app/answers/detail/a_id/4613
http://nvidia.custhelp.com/app/answers/detail/a_id/4614
http://xenbits.xen.org/xsa/advisory-254.html
https://01.org/security/advisories/intel-oss-10002
https://access.redhat.com/security/vulnerabilities/speculativeexecution
https://aws.amazon.com/de/security/security-bulletins/AWS-2018-013/
https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/
https://webkit.org/blog/8048/what-spectre-and-meltdown-mean-for-webkit/
https://developer.arm.com/support/security-update
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180002
https://security.netapp.com/advisory/ntap-20180104-0001/
https://support.citrix.com/article/CTX231399
https://support.f5.com/csp/article/K91229003
https://support.lenovo.com/us/en/solutions/LEN-18282
https://www.suse.com/c/suse-addresses-meltdown-spectre-vulnerabilities/
https://www.synology.com/support/security/Synology_SA_18_01
https://www.vmware.com/us/security/advisories/VMSA-2018-0002.html
https://support.apple.com/en-us/HT208394
https://support.apple.com/en-us/HT208397
https://support.apple.com/en-us/HT208401
https://support.apple.com/en-us/HT208403
https://source.android.com/security/bulletin/2018-01-01
http://www.huawei.com/en/psirt/security-notices/huawei-sn-20180104-01-intel-en

Обновление программного обеспечения Siemens AG до V3.1:
https://support.industry.siemens.com/cs/ww/en/view/109761864

Для ОС ОН «Стрелец»:
Обновление программного обеспечения libvirt до версии 3.0.0-4+deb9u5

Использование рекомендаций:
Для Linux:
https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.27
https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.15.10
https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.127
https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.88

Для ОС Astra Linux 1.5 https://wiki.astralinux.ru/pages/viewpage.action?pageId=1212483

Для ОС Astra Linux 1.6 https://wiki.astralinux.ru/pages/viewpage.action?pageId=44892734

URL: https://bdu.fstec.ru/vul/2018-00002

Vulnerable Software (1700)

Type: Configuration

Vendor: advanced micro devices inc.

Product: amd

Operating System: debian gnu/linux 8

Trait: 
{  "version_exact": "*"}

Source: bdu

Type: Configuration

Vendor: advanced micro devices inc.

Product: amd

Operating System: debian gnu/linux 10

Trait: 
{  "version_exact": "*"}

Source: bdu

Type: Configuration

Vendor: advanced micro devices inc.

Product: amd

Operating System: solaris 11.3

Trait: 
{  "version_exact": "*"}

Source: bdu

Type: Configuration

Vendor: advanced micro devices inc.

Product: amd

Operating System: debian gnu/linux 9

Trait: 
{  "version_exact": "*"}

Source: bdu

Type: Configuration

Vendor: advanced micro devices inc.

Product: amd

Operating System: ubuntu 12.04 ESM

Trait: 
{  "version_exact": "*"}

Source: bdu

Type: Configuration

Vendor: advanced micro devices inc.

Product: amd

Operating System: роса кобальт *

Trait: 
{  "version_exact": "*"}

Source: bdu

Type: Configuration

Vendor: advanced micro devices inc.

Product: amd

Operating System: rels 6.x

Trait: 
{  "version_exact": "*"}

Source: bdu

Type: Configuration

Vendor: advanced micro devices inc.

Product: amd

Operating System: solaris 10

Trait: 
{  "version_exact": "*"}

Source: bdu

Type: Configuration

Vendor: advanced micro devices inc.

Product: amd

Operating System: opensuse leap 15.0

Trait: 
{  "version_exact": "*"}

Source: bdu

Type: Configuration

Vendor: advanced micro devices inc.

Product: amd

Operating System: linux *

Trait: 
{  "version_exact": "*"}

Source: bdu

Type: Configuration

Vendor: advanced micro devices inc.

Product: amd

Operating System: ubuntu 14.04 LTS

Trait: 
{  "version_exact": "*"}

Source: bdu

Type: Configuration

Vendor: advanced micro devices inc.

Product: amd

Operating System: ubuntu 16.04 LTS

Trait: 
{  "version_exact": "*"}

Source: bdu

Type: Configuration

Vendor: advanced micro devices inc.

Product: amd

Operating System: opensuse leap 42.2

Trait: 
{  "version_exact": "*"}

Source: bdu

Type: Configuration

Vendor: advanced micro devices inc.

Product: amd

Operating System: ubuntu 17.04

Trait: 
{  "version_exact": "*"}

Source: bdu

Type: Configuration

Vendor: advanced micro devices inc.

Product: amd

Operating System: opensuse leap 42.3

Trait: 
{  "version_exact": "*"}

Source: bdu

Type: Configuration

Vendor: advanced micro devices inc.

Product: amd

Operating System: ubuntu 17.10

Trait: 
{  "version_exact": "*"}

Source: bdu

Type: Configuration

Vendor: advanced micro devices inc.

Product: amd

Operating System: altlinux 8

Trait: 
{  "version_exact": "*"}

Source: bdu

Type: Configuration

Vendor: advanced micro devices inc.

Product: amd

Operating System: astra 1.5

Trait: 
{  "version_exact": "*"}

Source: bdu

Type: Configuration

Vendor: advanced micro devices inc.

Product: amd

Operating System: altlinux 7.0

Trait: 
{  "version_exact": "*"}

Source: bdu

Type: Configuration

Vendor: advanced micro devices inc.

Product: amd

Operating System: astra 1.6

Trait: 
{  "version_exact": "*"}

Source: bdu