Описание
Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution for some Intel(R) Processors within VMX non-root (guest) operation may allow an information disclosure. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (none) and availability (none) impacts.
A flaw was found in the kernel. This vulnerability, affecting some Intel(R) Processors, involves shared microarchitectural predictor state that influences transient execution within VMX non-root (guest) operation. An unprivileged software adversary with an authenticated user can exploit this locally to disclose sensitive information. This high-complexity attack requires no user interaction and can lead to significant data exposure.
Отчет
This Moderate impact information disclosure flaw affects Intel processors in virtualized environments utilizing VMX non-root (guest) operation. An authenticated, unprivileged local attacker could exploit shared microarchitectural predictor states to transiently execute code and potentially expose sensitive data. The high complexity of the attack reduces its immediate threat.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | microcode_ctl | Fix deferred | ||
| Red Hat Enterprise Linux 6 | microcode_ctl | Fix deferred | ||
| Red Hat Enterprise Linux 7 | microcode_ctl | Fix deferred | ||
| Red Hat Enterprise Linux 8 | microcode_ctl | Fix deferred | ||
| Red Hat Enterprise Linux 9 | microcode_ctl | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.6 Medium
CVSS3
Связанные уязвимости
Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution for some Intel(R) Processors within VMX non-root (guest) operation may allow an information disclosure. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (none) and availability (none) impacts.
Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution for some Intel(R) Processors within VMX non-root (guest) operation may allow an information disclosure. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (none) and availability (none) impacts.
Exposure of sensitive information caused by shared microarchitectural ...
EPSS
5.6 Medium
CVSS3