# MA-691.012018: MyCERT Alert - CPU Hardware Side-Channel Attacks Vulnerability

**Date:** 05 Jan 2018  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-691.012018  
**Advisory ID:** MA-691.012018

---

**1.0 Overview**
MyCERT is aware of a set of security vulnerabilities—known as Meltdown and Spectre—that affect modern computer processors. Malaysia National Cyber Security Agency (NACSA) has released an alert regarding this matter. Users may refer to the URL below for details:
- <http://www.nc4.gov.my/alert_advisory_public>
**2.0 Description**
CPU hardware implementations are vulnerable to side-channel attacks referred to as ‘Meltdown’ and ‘Spectre’. Both vulnerabilities take advantage of the ability to extract information from instructions that have executed on a CPU using the CPU cache as a side-channel. These hardware flaws allow programs to steal data which is currently processed on the computer. The issues are organized into three (3) variants:
|  |  |
| --- | --- | --- | --- | --- | **No** | **Variant** | **CVE** | **Name** | **Vulnerability** | 1. | Variant 1 | CVE-2017-5753 | Bounds Check Bypass | Spectre | 2. | Variant 2 | CVE-2017-5715 | Branch Target Injection | Spectre | 3. | Variant 3 | CVE-2017-5754 | Rogue Data Cache Load | Meltdown |
**3.0 Impact**
Exploitation of these vulnerabilities could allow an attacker to obtain access to sensitive information. An attacker able to execute code with user privileges can achieve various impacts, such as reading otherwise protected kernel memory and bypassing KASLR.
**4.0 Affected Products**
These vulnerabilities affect many CPUs, including those from AMD, ARM, and Intel, as well as the devices and operating systems running on them.
**5.0 Recommendations**
Users and administrators are encouraged to review the below URLs for more information and refer to CPU, OS & application vendors for necessary patches.
|  |
| --- | --- | --- | **No.** | **Vendor** | **URL** | 1 | Amazon | <https://aws.amazon.com/security/security-bulletins/AWS-2018-013/> | 2 | AMD | <https://www.amd.com/en/corporate/speculative-execution> | 3 | Android | <https://source.android.com/security/bulletin/2018-01-01> | 4 | Apple | <https://support.apple.com/en-us/HT208394> | 5 | ARM | <https://developer.arm.com/support/security-update> | 6 | CentOS | <https://lists.centos.org/pipermail/centos-announce/2018-January/date.html> | 7 | Chromium | <https://www.chromium.org/Home/chromium-security/ssca> | 8 | Citrix | <https://support.citrix.com/article/CTX231399> | 9 | F5 | <https://support.f5.com/csp/article/K91229003> | 10 | Google | <https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html> | 11 | Huawei | <http://www.huawei.com/en/psirt/security-notices/huawei-sn-20180104-01-intel-en> | 12 | IBM | <https://exchange.xforce.ibmcloud.com/collection/Central-Processor-Unit-CPU-Architectural-Design-Flaws-c422fb7c4f08a679812cf1190db15441> | 13 | Intel | <https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00088&languageid=en-fr> | 14 | Lenovo | <https://support.lenovo.com/us/en/solutions/len-18282> | 15 | Linux | <https://lkml.org/lkml/2017/12/4/709> | 16 | Microsoft Azure | <https://azure.microsoft.com/en-us/blog/securing-azure-customers-from-cpu-vulnerability/> | 17 | Microsoft | <https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180002> | 18 | Mozilla | <https://www.mozilla.org/en-US/security/advisories/mfsa2018-01/> | 19 | NVIDIA | <http://nvidia.custhelp.com/app/answers/detail/a_id/4609> | 20 | OpenSUSE | <https://lists.opensuse.org/opensuse-security-announce/2018-01/msg00001.html> | 21 | Red Hat | <https://access.redhat.com/security/security-updates/#/security-advisories?q=&p=1&sort=portal_publication_date%20desc&rows=10&documentKind=PortalProduct> | 22 | SuSE | <http://lists.suse.com/pipermail/sle-security-updates/2018-January/date.html> | 23 | Trend Micro | <https://success.trendmicro.com/solution/1119183-important-information-for-trend-micro-solutions-and-microsoft-january-2018-security-updates> | 24 | VMWare | <https://www.vmware.com/security/advisories/VMSA-2018-0002.html> | 25 | Xen | <http://xenbits.xen.org/xsa/advisory-254.html> |
Generally, MyCERT advises users of this product to be updated with the latest security announcements made by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#d4b7adb6b1a6ededed94b7adb6b1a6a7b1b7a1a6bda0adfab9ad) or [[email protected]](/cdn-cgi/l/email-protection#2f42564c4a5d5b6f42564c4a5d5b01405d48014256)
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442
Handphone: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 AM - 18:00 PM MYT
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**6.0 References**
- <http://www.nc4.gov.my/alert_advisory_public>
- <https://www.us-cert.gov/ncas/alerts/TA18-004A>
- <http://www.kb.cert.org/vuls/id/584653>
- <https://spectreattack.com/>
- <https://meltdownattack.com/>
- <https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180002>
- <https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html?m=1>
- <https://www.us-cert.gov/ncas/current-activity/2018/01/03/Meltdown-and-Spectre-Side-Channel-Vulnerabilities>
- <https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/>