{"id":2522,"date":"2018-05-21T20:54:08","date_gmt":"2018-05-21T13:54:08","guid":{"rendered":"https:\/\/humanit.asia\/?p=2522"},"modified":"2019-07-22T14:58:02","modified_gmt":"2019-07-22T07:58:02","slug":"ta18-141a","status":"publish","type":"post","link":"https:\/\/old.humanit.asia\/th\/ta18-141a\/","title":{"rendered":"TA18-141A: Side-Channel Vulnerability Variants 3a and 4"},"content":{"rendered":"
\n

Original release date: May 21, 2018<\/p>\n

Systems Affected<\/h3>\n

CPU hardware implementations<\/p>\n

Overview<\/h3>\n

On May 21, 2018, new variants\u2014known as 3A and 4\u2014of the side-channel central processing unit (CPU) hardware vulnerability were publically disclosed<\/a>. These variants can allow an attacker to obtain access to sensitive information on affected systems.<\/p>\n

Description<\/h3>\n

CPU hardware implementations\u2014known as Spectre and Meltdown<\/a>\u2014are vulnerable to side-channel attacks. Meltdown is a bug that “melts” the security boundaries normally enforced by the hardware, affecting desktops, laptops, and cloud computers. Spectre is a flaw that an attacker can exploit to force a CPU to reveal its data.<\/p>\n

Variant 3a is a vulnerability that may allow an attacker with local access to speculatively read system parameters via side-channel analysis and obtain sensitive information.<\/p>\n

Variant 4 is a vulnerability that exploits \u201cspeculative bypass.\u201d When exploited, Variant 4 could allow an attacker to read older memory values in a CPU\u2019s stack or other memory locations. While implementation is complex, this side-channel vulnerability could allow less privileged code to<\/p>\n