Speculative Execution Vulnerability Affects Modern CPUs
CVE-2024-2193

5.7MEDIUM

Key Information:

Vendor
Amd
Status
Cpu
Xen Project
Vendor
CVE Published:
15 March 2024

Badges

💰 Ransomware👾 Exploit Exists📰 News Worthy

Summary

This vulnerability involves a speculative race condition that targets modern CPU architectures equipped with speculative execution capabilities. Unauthorized attackers may exploit this flaw to retrieve sensitive data from the CPU by manipulating race conditions, thereby gaining access to speculative execution paths. This exploitation can lead to the unintended disclosure of confidential information, emphasizing the importance of applying necessary security updates and patches to affected products to mitigate this risk.

Affected Version(s)

CPU See advisory AMD-SB-7016

Xen consult Xen advisory XSA-453

News Articles

favicon imageLinux Security

New GhostRace Attack Impacts Major CPU, Software Vendors | LinuxSecurity.com

What Is the GhostRace Attack? IBM and VU Amsterdam University researchers have identified a new

favicon imageRisky Biz

Risky Biz News: NIST NVD stopped enriching CVEs a month ago

In other news: LockBit member sentenced to prison; CIA runs anti-China info-op; new GhostRace side-channel attack.

favicon imageHeimdal Security

Researchers Disclose Proof of Concept for New GhostRace Attack

IBM and VU Amsterdam University researchers published on March 12th their study about the new GhostRace attack type.

References

https://kb.cert.org/vuls/id/488902
https://xenbits.xen.org/xsa/advisory-453.html
https://www.vusec.net/projects/ghostrace/

CVSS V3.1

Score:
5.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • 💰

    Used in Ransomware

  • 👾

    Exploit known to exist

  • Vulnerability published

  • 📰

    First article discovered by vusec

  • Vulnerability Reserved

Credit

Thanks to Hany Ragab and Cristiano Giuffrida from the VUSec group at VU Amsterdam and Andrea Mambretti and Anil Kurmus from IBM Research Europe, Zurich for discovering and reporting this vulnerability.
.