58 hardware vulnerabilities: A guide to the threats
CSO Online reference guide catalogs 58 CPU and DRAM hardware vulnerabilities from Spectre and Meltdown onward, covering side-channel flaws and mitigation limits.
The guide surveys significant CPU and DRAM vulnerabilities discovered since Meltdown and Spectre (January 2018) exposed speculative-execution risks affecting Intel, IBM and ARM processors. Entries include Foreshadow, Zombieload, Retbleed, Downfall, Inception, GoFetch and SinkClose, detailing side-channel impact and mitigations via microcode, BIOS/UEFI or OS updates. It notes some flaws cannot be fully fixed without new silicon generations, so affected devices can remain impacted long-term.
- Catalogs 58 hardware flaws spanning Spectre variants through recent transient-execution attacks.
- Speculative-execution side channels cross kernel/user and VM boundaries to leak sensitive memory.
- Mitigation requires coordinated microcode, BIOS/UEFI and OS patching; some flaws need new silicon.
- CVEs
- CVE-2017-5753CVE-2017-5715CVE-2017-5754CVE-2018-3640CVE-2018-3665CVE-2018-3639CVE-2018-3693CVE-2018-3620CVE-2018-3646CVE-2018-3615
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2017-5753+2 related CVEs | Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local… | 5.6 | 94% | PoC | |
CVE-2018-3615+2 related CVEs | Systems with microprocessors utilizing speculative execution and Intel software guard extensions (Intel SGX) may allow unauthorized disclosure of information… | 7.3 group max | 6% | ||
CVE-2018-3639+1 related CVE | Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are… | 5.5 group max | 61% | ||
| CVE-2018-3665 | System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially allow a local process to infer data… | 5.6 | <1% | ||
| CVE-2018-3693 | Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local… | 5.6 | 9% |
From the original article
13 min read at csoonline.com
In January 2018, the entire computer industry was put on alert by two new processor vulnerabilities dubbed Meltdown and Spectre that defeated the fundamental OS security boundaries separating kernel and user space memory.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.