Vulnerability-Lookup

BDU:2018-00994 (CVE-2018-3615)

Vulnerability from fstec – Published: 2018-08-16 – Updated: 2021-03-23 – View on bdu.fstec.ru Fixed

Title

Уязвимость реализации технологии Software Guard eXtensions процессоров Intel, позволяющая получить несанкционированный доступ к данным, размещённым в защищённой области

Summary

Уязвимость реализации технологии Software Guard eXtensions (SGX) процессоров Intel связана с возможностью спекулятивного выполнения команд. Эксплуатация уязвимости может позволить нарушителю получить несанкционированный доступ к данным программы, защищаемым при помощи технологии SGX, путём реализации атаки по побочным каналам, позволяющей прочесть данные кэша первого уровня (L1), в котором после спекулятивного выполнения остаются фрагменты данных из защищаемой области

Severity

5.4 (Medium) CVSS 2.0


                      
                        AV:L/AC:M/Au:N/C:C/I:P/A:N

7.9 (High) CVSS 3.0


                      
                        CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Class

Architecture vulnerability

Status

Confirmed by the vendor

Exploitation

Timing and state manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-524 - Раскрытие информации посредством кэширования

Aliases

CVE-2018-3615, INTEL-SA-00161

References

8 references

URL
http://www.foreshadowattack.com/
https://foreshadowattack.eu/foreshadow.pdf
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00161.html
https://software.intel.com/security-software-guidance/software-guidance/l1-term…
https://nvd.nist.gov/vuln/detail/CVE-2018-3615
https://security-tracker.debian.org/tracker/CVE-2018-3615
https://cert-portal.siemens.com/productcert/pdf/ssa-254686.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-608355.pdf

Impacted products

42 products from 3 vendors

Vendors

Intel Corp., ООО «РусБИТех-Астра», Siemens AG

Products

Intel Xeon, Intel Core, Astra Linux Special Edition (запись в едином реестре российских программ №369), Intel SGX, SIMATIC Field PG M5, SIMATIC IPC427E, SIMATIC IPC477E, SIMATIC IPC547E, SIMATIC IPC547G, SIMATIC IPC627D, SIMATIC IPC647D, SIMATIC IPC677D, SIMATIC IPC827D, SIMATIC IPC847D, SIMATIC ITP1000, SIMATIC IPC427C, SIMATIC IPC477C, RUGGEDCOM APE, RUGGEDCOM RX1400 VPE, SIMATIC ET 200SP Open Controller, SIMATIC ET 200 SP Open Controller (F), SIMATIC Field PG M4, SIMATIC IPC3000 SMART V2, SIMATIC IPC347E, SIMATIC IPC427D, SIMATIC IPC477D, SIMATIC IPC477E Pro, SIMATIC IPC627C, SIMATIC IPC647C, SIMATIC IPC677C, SIMATIC IPC827C, SIMATIC IPC847C, SIMATIC S7-1500 CPU S7-1518-4 PN/DP MFP, SIMATIC S7-1500 CPU S7-1518F-4 PN/DP MFP, SIMATIC S7-1500 Software Controller, SIMOTION P320-4E, SIMOTION P320-4S, SINUMERIK 840D sl, SINUMERIK PCU 50.5, SINUMERIK Panels с интегрированной TCU, SINUMERIK TCU 30.3, SIMATIC WinAC RTX 2010 incl. F

Versions

- (Intel Xeon), - (Intel Core), 1.6 «Смоленск» (Astra Linux Special Edition), до 3.20180703.1 (Intel SGX), до 22.01.06 (SIMATIC Field PG M5), до 21.01.09 (SIMATIC IPC427E), до 21.01.09 (SIMATIC IPC477E), до R1.30.0 (SIMATIC IPC547E), до R1.23.0 (SIMATIC IPC547G), до 19.02.11 (SIMATIC IPC627D), до 19.01.14 (SIMATIC IPC647D), до 19.02.11 (SIMATIC IPC677D), до 19.02.11 (SIMATIC IPC827D), до 19.01.14 (SIMATIC IPC847D), до 23.01.04 (SIMATIC ITP1000), - (SIMATIC IPC427C), - (SIMATIC IPC477C), - (RUGGEDCOM APE), - (RUGGEDCOM RX1400 VPE), - (SIMATIC ET 200SP Open Controller), - (SIMATIC ET 200 SP Open Controller (F)), до 18.01.09 (SIMATIC Field PG M4), до 1.4 (SIMATIC IPC3000 SMART V2), до 1.4 (SIMATIC IPC347E), до 17.0X.14 (SIMATIC IPC427D), до 17.0X.14 (SIMATIC IPC477D), до 21.01.09 (SIMATIC IPC477E Pro), до 15.02.15 (SIMATIC IPC627C), до 15.01.14 (SIMATIC IPC647C), до 15.02.15 (SIMATIC IPC677C), до 15.02.15 (SIMATIC IPC827C), до 15.01.14 (SIMATIC IPC847C), до 2.6 (SIMATIC S7-1500 CPU S7-1518-4 PN/DP MFP), до 2.6 (SIMATIC S7-1500 CPU S7-1518F-4 PN/DP MFP), - (SIMATIC S7-1500 Software Controller), до 17.0X.14 (SIMOTION P320-4E), до 17.0X.14 (SIMOTION P320-4S), - (SINUMERIK 840D sl), до 15.02.15 (SINUMERIK PCU 50.5), Выпущенные до 2016 включительно (SINUMERIK Panels с интегрированной TCU), - (SINUMERIK TCU 30.3), до SP3 (SIMATIC WinAC RTX 2010 incl. F)

Product types

Appliance software, Operating system, Firmware, Средство АСУ ТП, ПО программно-аппаратного средства АСУ ТП, Network appliance software, Industrial control system software

Platforms

Intel Corp. - - Intel Core, Intel Corp. - - Intel Xeon

Mitigations

Для Intel SGX: Обновление программного обеспечения до 3.20180703.1 или более поздней версии Для Astra Linux: Обновление программного обеспечения (пакета intel-microcode) до 3.20180807a.1~deb8u1 или более поздней версии Использование рекомендаций разработчика: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00161.html Для SIMATIC Field PG M4 до версии BIOS V18.01.09: https://support.industry.siemens.com/cs/de/en/view/109037537 Для SIMATIC Field PG M5 до версии BIOS V22.01.06: https://support.industry.siemens.com/cs/de/en/view/109738122 Для SIMATIC IPC3000 SMART V2 и SIMATIC IPC347E до версии BIOS V1.4: https://support.industry.siemens.com/cs/ww/en/view/109759824 Для SIMATIC IPC427D, SIMATIC IPC477D, SIMOTION P320-4E и SIMOTION P320-4S до версии BIOS V17.0X.14: https://support.industry.siemens.com/cs/de/en/view/108608500 Для SIMATIC IPC427E, SIMATIC IPC477E и SIMATIC IPC477E Pro до версии BIOS V21.01.09: https://support.industry.siemens.com/cs/de/en/view/109742593 Для SIMATIC IPC547E до версии BIOS R1.30.0: https://support.industry.siemens.com/cs/us/en/view/109481624 Для SIMATIC IPC547G до версии BIOS R1.23.0: https://support.industry.siemens.com/cs/us/en/view/109750349 Для SIMATIC IPC627D, SIMATIC IPC677D и SIMATIC IPC827D до версии BIOS V19.02.11: https://support.industry.siemens.com/cs/ww/de/view/109474954 Для SIMATIC IPC627C, SIMATIC IPC677C, SINUMERIK PCU 50.5 и SIMATIC IPC827C до версии BIOS V15.02.15: https://support.industry.siemens.com/cs/ww/en/view/48792087 Для SIMATIC IPC647C и SIMATIC IPC847C до версии BIOS V15.01.14: https://support.industry.siemens.com/cs/ww/en/view/48792076 Для SIMATIC IPC647D и SIMATIC IPC847D до версии BIOS V19.01.14: https://support.industry.siemens.com/cs/ww/en/view/109037779 Для SIMATIC ITP1000 до версии BIOS V23.01.04: https://support.industry.siemens.com/cs/us/en/view/109748173 Для SIMATIC S7-1500 CPU S7-1518-4 PN/DP MFP и SIMATIC S7-1500 CPU S7-1518F-4 PN/DP MFP до версии BIOS V2.6: https://support.industry.siemens.com/cs/ww/en/view/109478459 Для SIMATIC WinAC RTX (F) 2010 до SIMATIC WinAC RTX 2010 SP3: https://support.industry.siemens.com/cs/ww/en/view/109765109 Компенсирующие меры: Для RUGGEDCOM APE и RUGGEDCOM RX1400 VPE: Применение исправлений Debian по мере их появления Ограничение возможностей запуска ненадежного кода, если это возможно Применение концепции углубленной защиты https://www.siemens.com/industrialsecurity

Credits

Класс атак, связанных с уязвимостью, получил название Foreshadow (название предложено исследователями, выявившими уязвимость) и L1 Terminal Fault (название используется разработчиком Intel)

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:M/Au:N/C:C/I:P/A:N",
  "CVSS 3.0": "AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Intel Corp., \u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb, Siemens AG",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "- (Intel Xeon), - (Intel Core), 1.6 \u00ab\u0421\u043c\u043e\u043b\u0435\u043d\u0441\u043a\u00bb (Astra Linux Special Edition), \u0434\u043e 3.20180703.1 (Intel SGX), \u0434\u043e 22.01.06 (SIMATIC Field PG M5), \u0434\u043e 21.01.09 (SIMATIC IPC427E), \u0434\u043e 21.01.09 (SIMATIC IPC477E), \u0434\u043e R1.30.0 (SIMATIC IPC547E), \u0434\u043e R1.23.0 (SIMATIC IPC547G), \u0434\u043e 19.02.11 (SIMATIC IPC627D), \u0434\u043e 19.01.14 (SIMATIC IPC647D), \u0434\u043e 19.02.11 (SIMATIC IPC677D), \u0434\u043e 19.02.11 (SIMATIC IPC827D), \u0434\u043e 19.01.14 (SIMATIC IPC847D), \u0434\u043e 23.01.04 (SIMATIC ITP1000), - (SIMATIC IPC427C), - (SIMATIC IPC477C), - (RUGGEDCOM APE), - (RUGGEDCOM RX1400 VPE), - (SIMATIC ET 200SP Open Controller), - (SIMATIC ET 200 SP Open Controller (F)), \u0434\u043e 18.01.09 (SIMATIC Field PG M4), \u0434\u043e 1.4 (SIMATIC IPC3000 SMART V2), \u0434\u043e 1.4 (SIMATIC IPC347E), \u0434\u043e 17.0X.14 (SIMATIC IPC427D), \u0434\u043e 17.0X.14 (SIMATIC IPC477D), \u0434\u043e 21.01.09 (SIMATIC IPC477E Pro), \u0434\u043e 15.02.15 (SIMATIC IPC627C), \u0434\u043e 15.01.14 (SIMATIC IPC647C), \u0434\u043e 15.02.15 (SIMATIC IPC677C), \u0434\u043e 15.02.15 (SIMATIC IPC827C), \u0434\u043e 15.01.14 (SIMATIC IPC847C), \u0434\u043e 2.6 (SIMATIC S7-1500 CPU S7-1518-4 PN/DP MFP), \u0434\u043e 2.6 (SIMATIC S7-1500 CPU S7-1518F-4 PN/DP MFP), - (SIMATIC S7-1500 Software Controller), \u0434\u043e 17.0X.14 (SIMOTION P320-4E), \u0434\u043e 17.0X.14 (SIMOTION P320-4S), - (SINUMERIK 840D sl), \u0434\u043e 15.02.15 (SINUMERIK PCU 50.5), \u0412\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0435 \u0434\u043e 2016 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (SINUMERIK Panels \u0441 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 TCU), - (SINUMERIK TCU 30.3), \u0434\u043e SP3 (SIMATIC WinAC RTX 2010 incl. F)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0414\u043b\u044f Intel SGX:\n\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0434\u043e 3.20180703.1 \u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0437\u0434\u043d\u0435\u0439 \u0432\u0435\u0440\u0441\u0438\u0438\n\n\u0414\u043b\u044f Astra Linux:\n\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f (\u043f\u0430\u043a\u0435\u0442\u0430 intel-microcode) \u0434\u043e 3.20180807a.1~deb8u1 \u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0437\u0434\u043d\u0435\u0439 \u0432\u0435\u0440\u0441\u0438\u0438\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430:\nhttps://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00161.html\n\n\u0414\u043b\u044f SIMATIC Field PG M4 \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 BIOS V18.01.09:\nhttps://support.industry.siemens.com/cs/de/en/view/109037537\n\n\u0414\u043b\u044f SIMATIC Field PG M5 \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 BIOS V22.01.06:\nhttps://support.industry.siemens.com/cs/de/en/view/109738122\n\n\u0414\u043b\u044f SIMATIC IPC3000 SMART V2 \u0438 SIMATIC IPC347E \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 BIOS V1.4:\nhttps://support.industry.siemens.com/cs/ww/en/view/109759824\n\n\u0414\u043b\u044f SIMATIC IPC427D, SIMATIC IPC477D, SIMOTION P320-4E \u0438 SIMOTION P320-4S \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 BIOS V17.0X.14:\nhttps://support.industry.siemens.com/cs/de/en/view/108608500\n\n\u0414\u043b\u044f SIMATIC IPC427E, SIMATIC IPC477E \u0438 SIMATIC IPC477E Pro \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 BIOS V21.01.09:\nhttps://support.industry.siemens.com/cs/de/en/view/109742593\n\n\u0414\u043b\u044f SIMATIC IPC547E \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 BIOS R1.30.0:\nhttps://support.industry.siemens.com/cs/us/en/view/109481624\n\n\u0414\u043b\u044f SIMATIC IPC547G \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 BIOS R1.23.0:\nhttps://support.industry.siemens.com/cs/us/en/view/109750349\n\n\u0414\u043b\u044f SIMATIC IPC627D, SIMATIC IPC677D \u0438 SIMATIC IPC827D \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 BIOS V19.02.11: https://support.industry.siemens.com/cs/ww/de/view/109474954\n\n\u0414\u043b\u044f SIMATIC IPC627C, SIMATIC IPC677C, SINUMERIK PCU 50.5 \u0438 SIMATIC IPC827C \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 BIOS V15.02.15:\nhttps://support.industry.siemens.com/cs/ww/en/view/48792087\n\n\u0414\u043b\u044f SIMATIC IPC647C \u0438 SIMATIC IPC847C \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 BIOS V15.01.14:\nhttps://support.industry.siemens.com/cs/ww/en/view/48792076\n\n\u0414\u043b\u044f SIMATIC IPC647D \u0438 SIMATIC IPC847D \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 BIOS V19.01.14:\nhttps://support.industry.siemens.com/cs/ww/en/view/109037779\n\n\u0414\u043b\u044f SIMATIC ITP1000 \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 BIOS V23.01.04:\nhttps://support.industry.siemens.com/cs/us/en/view/109748173\n\n\u0414\u043b\u044f SIMATIC S7-1500 CPU S7-1518-4 PN/DP MFP \u0438 SIMATIC S7-1500 CPU S7-1518F-4 PN/DP MFP \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 BIOS V2.6:\nhttps://support.industry.siemens.com/cs/ww/en/view/109478459\n\n\u0414\u043b\u044f SIMATIC WinAC RTX (F) 2010 \u0434\u043e SIMATIC WinAC RTX 2010 SP3:\nhttps://support.industry.siemens.com/cs/ww/en/view/109765109\n\n\n\u041a\u043e\u043c\u043f\u0435\u043d\u0441\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0440\u044b:\n\n\u0414\u043b\u044f RUGGEDCOM APE \u0438 RUGGEDCOM RX1400 VPE:\n\u041f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439 Debian \u043f\u043e \u043c\u0435\u0440\u0435 \u0438\u0445 \u043f\u043e\u044f\u0432\u043b\u0435\u043d\u0438\u044f\n\n\u041e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0435\u0439 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043d\u0435\u043d\u0430\u0434\u0435\u0436\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430, \u0435\u0441\u043b\u0438 \u044d\u0442\u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\n\u041f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438 \u0443\u0433\u043b\u0443\u0431\u043b\u0435\u043d\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b\nhttps://www.siemens.com/industrialsecurity",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "03.01.2018",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "23.03.2021",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "16.08.2018",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2018-00994",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2018-3615, INTEL-SA-00161",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Intel Xeon, Intel Core, Astra Linux Special Edition (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u2116369), Intel SGX, SIMATIC Field PG M5, SIMATIC IPC427E, SIMATIC IPC477E, SIMATIC IPC547E, SIMATIC IPC547G, SIMATIC IPC627D, SIMATIC IPC647D, SIMATIC IPC677D, SIMATIC IPC827D, SIMATIC IPC847D, SIMATIC ITP1000, SIMATIC IPC427C, SIMATIC IPC477C, RUGGEDCOM APE, RUGGEDCOM RX1400 VPE, SIMATIC ET 200SP Open Controller, SIMATIC ET 200 SP Open Controller (F), SIMATIC Field PG M4, SIMATIC IPC3000 SMART V2, SIMATIC IPC347E, SIMATIC IPC427D, SIMATIC IPC477D, SIMATIC IPC477E Pro, SIMATIC IPC627C, SIMATIC IPC647C, SIMATIC IPC677C, SIMATIC IPC827C, SIMATIC IPC847C, SIMATIC S7-1500 CPU S7-1518-4 PN/DP MFP, SIMATIC S7-1500 CPU S7-1518F-4 PN/DP MFP, SIMATIC S7-1500 Software Controller, SIMOTION P320-4E, SIMOTION P320-4S, SINUMERIK 840D sl, SINUMERIK PCU 50.5, SINUMERIK Panels \u0441 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 TCU, SINUMERIK TCU 30.3, SIMATIC WinAC RTX 2010 incl. F",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Intel Corp. - - Intel Core, Intel Corp. - - Intel Xeon",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 Software Guard eXtensions \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u0432 Intel, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0434\u0430\u043d\u043d\u044b\u043c, \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u043c \u0432 \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0439 \u043e\u0431\u043b\u0430\u0441\u0442\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c \u043a\u044d\u0448\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f (CWE-524)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 Software Guard eXtensions (SGX) \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u0432 Intel \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u0441\u043f\u0435\u043a\u0443\u043b\u044f\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0434\u0430\u043d\u043d\u044b\u043c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b, \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u044b\u043c \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 SGX, \u043f\u0443\u0442\u0451\u043c \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0430\u0442\u0430\u043a\u0438 \u043f\u043e \u043f\u043e\u0431\u043e\u0447\u043d\u044b\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043f\u0440\u043e\u0447\u0435\u0441\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u043a\u044d\u0448\u0430 \u043f\u0435\u0440\u0432\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f (L1), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u043e\u0441\u043b\u0435 \u0441\u043f\u0435\u043a\u0443\u043b\u044f\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u044b \u0434\u0430\u043d\u043d\u044b\u0445 \u0438\u0437 \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u043e\u0431\u043b\u0430\u0441\u0442\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": "\u041a\u043b\u0430\u0441\u0441 \u0430\u0442\u0430\u043a, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e, \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 Foreshadow (\u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438, \u0432\u044b\u044f\u0432\u0438\u0432\u0448\u0438\u043c\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c) \u0438 L1 Terminal Fault (\u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u043c Intel)",
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0440\u043e\u043a\u0430\u043c\u0438 \u0438 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435\u043c",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "http://www.foreshadowattack.com/\nhttps://foreshadowattack.eu/foreshadow.pdf\nhttps://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00161.html\nhttps://software.intel.com/security-software-guidance/software-guidance/l1-terminal-fault\nhttps://nvd.nist.gov/vuln/detail/CVE-2018-3615\nhttps://security-tracker.debian.org/tracker/CVE-2018-3615\nhttps://cert-portal.siemens.com/productcert/pdf/ssa-254686.pdf\nhttps://cert-portal.siemens.com/productcert/pdf/ssa-608355.pdf\nhttps://nvd.nist.gov/vuln/detail/CVE-2018-3615",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u041e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430, \u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u041c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0439 \u043a\u043e\u0434, \u0421\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0410\u0421\u0423 \u0422\u041f, \u041f\u041e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0410\u0421\u0423 \u0422\u041f, \u041f\u041e \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430, \u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0410\u0421\u0423 \u0422\u041f",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-524",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5,4)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,9)"
}

CVE-2018-3615 (GCVE-0-2018-3615)

Vulnerability from cvelistv5 – Published: 2018-08-14 19:00 – Updated: 2026-05-29 20:12

Summary

Systems with microprocessors utilizing speculative execution and Intel software guard extensions (Intel SGX) may allow unauthorized disclosure of information residing in the L1 data cache from an enclave to an attacker with local user access via a side-channel analysis.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-29 20:11 UTC

CWE

Information Disclosure
CWE-203 - Observable Discrepancy

Assigner

intel CNA under the mitre root

CNA scorecard C 60/100 over 96 records in the last 180 days details

References

17 references

URL	Tags
https://www.kb.cert.org/vuls/id/982149	third-party-advisoryx_refsource_CERT-VN
http://www.securitytracker.com/id/1041451	vdb-entryx_refsource_SECTRACK
https://psirt.global.sonicwall.com/vuln-detail/SN…	x_refsource_CONFIRM
http://www.securityfocus.com/bid/105080	vdb-entryx_refsource_BID
https://foreshadowattack.eu/	x_refsource_MISC
https://security.netapp.com/advisory/ntap-2018081…	x_refsource_CONFIRM
https://tools.cisco.com/security/center/content/C…	vendor-advisoryx_refsource_CISCO
https://support.f5.com/csp/article/K35558453	x_refsource_CONFIRM
http://support.lenovo.com/us/en/solutions/LEN-24163	x_refsource_CONFIRM
http://www.huawei.com/en/psirt/security-advisorie…	x_refsource_CONFIRM
https://www.intel.com/content/www/us/en/security-…	x_refsource_CONFIRM
https://www.synology.com/support/security/Synolog…	x_refsource_CONFIRM
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://cert-portal.siemens.com/productcert/pdf/s…	x_refsource_CONFIRM
https://support.hpe.com/hpsc/doc/public/display?d…	x_refsource_CONFIRM
https://software.intel.com/security-software-guid…	x_refsource_CONFIRM
https://cert-portal.siemens.com/productcert/pdf/s…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
Intel Corporation	Multiple	Affected: Multiple

Date Public

2018-08-14 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T04:50:30.411Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "VU#982149",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/982149"
          },
          {
            "name": "1041451",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1041451"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0008"
          },
          {
            "name": "105080",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/105080"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://foreshadowattack.eu/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20180815-0001/"
          },
          {
            "name": "20180814 CPU Side-Channel Information Disclosure Vulnerabilities: August 2018",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180814-cpusidechannel"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.f5.com/csp/article/K35558453"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.lenovo.com/us/en/solutions/LEN-24163"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180815-01-cpu-en"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00161.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.synology.com/support/security/Synology_SA_18_45"
          },
          {
            "name": "[debian-lts-announce] 20180916 [SECURITY] [DLA 1506-1] intel-microcode security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00017.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-254686.pdf"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03874en_us"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://software.intel.com/security-software-guidance/software-guidance/l1-terminal-fault"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-608355.pdf"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 7.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2018-3615",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-29T20:11:56.103053Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-203",
                "description": "CWE-203 Observable Discrepancy",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-29T20:12:06.324Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Multiple",
          "vendor": "Intel Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Multiple"
            }
          ]
        }
      ],
      "datePublic": "2018-08-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Systems with microprocessors utilizing speculative execution and Intel software guard extensions (Intel SGX) may allow unauthorized disclosure of information residing in the L1 data cache from an enclave to an attacker with local user access via a side-channel analysis."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Information Disclosure",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-10-08T12:06:06.000Z",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "name": "VU#982149",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "https://www.kb.cert.org/vuls/id/982149"
        },
        {
          "name": "1041451",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1041451"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0008"
        },
        {
          "name": "105080",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/105080"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://foreshadowattack.eu/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20180815-0001/"
        },
        {
          "name": "20180814 CPU Side-Channel Information Disclosure Vulnerabilities: August 2018",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180814-cpusidechannel"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.f5.com/csp/article/K35558453"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.lenovo.com/us/en/solutions/LEN-24163"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180815-01-cpu-en"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00161.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.synology.com/support/security/Synology_SA_18_45"
        },
        {
          "name": "[debian-lts-announce] 20180916 [SECURITY] [DLA 1506-1] intel-microcode security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00017.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-254686.pdf"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03874en_us"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://software.intel.com/security-software-guidance/software-guidance/l1-terminal-fault"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-608355.pdf"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@intel.com",
          "DATE_PUBLIC": "2018-08-14T00:00:00",
          "ID": "CVE-2018-3615",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Multiple",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Multiple"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Intel Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Systems with microprocessors utilizing speculative execution and Intel software guard extensions (Intel SGX) may allow unauthorized disclosure of information residing in the L1 data cache from an enclave to an attacker with local user access via a side-channel analysis."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Information Disclosure"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "VU#982149",
              "refsource": "CERT-VN",
              "url": "https://www.kb.cert.org/vuls/id/982149"
            },
            {
              "name": "1041451",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1041451"
            },
            {
              "name": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0008",
              "refsource": "CONFIRM",
              "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0008"
            },
            {
              "name": "105080",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/105080"
            },
            {
              "name": "https://foreshadowattack.eu/",
              "refsource": "MISC",
              "url": "https://foreshadowattack.eu/"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20180815-0001/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20180815-0001/"
            },
            {
              "name": "20180814 CPU Side-Channel Information Disclosure Vulnerabilities: August 2018",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180814-cpusidechannel"
            },
            {
              "name": "https://support.f5.com/csp/article/K35558453",
              "refsource": "CONFIRM",
              "url": "https://support.f5.com/csp/article/K35558453"
            },
            {
              "name": "http://support.lenovo.com/us/en/solutions/LEN-24163",
              "refsource": "CONFIRM",
              "url": "http://support.lenovo.com/us/en/solutions/LEN-24163"
            },
            {
              "name": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180815-01-cpu-en",
              "refsource": "CONFIRM",
              "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180815-01-cpu-en"
            },
            {
              "name": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00161.html",
              "refsource": "CONFIRM",
              "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00161.html"
            },
            {
              "name": "https://www.synology.com/support/security/Synology_SA_18_45",
              "refsource": "CONFIRM",
              "url": "https://www.synology.com/support/security/Synology_SA_18_45"
            },
            {
              "name": "[debian-lts-announce] 20180916 [SECURITY] [DLA 1506-1] intel-microcode security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00017.html"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-254686.pdf",
              "refsource": "CONFIRM",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-254686.pdf"
            },
            {
              "name": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03874en_us",
              "refsource": "CONFIRM",
              "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03874en_us"
            },
            {
              "name": "https://software.intel.com/security-software-guidance/software-guidance/l1-terminal-fault",
              "refsource": "CONFIRM",
              "url": "https://software.intel.com/security-software-guidance/software-guidance/l1-terminal-fault"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-608355.pdf",
              "refsource": "CONFIRM",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-608355.pdf"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2018-3615",
    "datePublished": "2018-08-14T19:00:00.000Z",
    "dateReserved": "2017-12-28T00:00:00.000Z",
    "dateUpdated": "2026-05-29T20:12:06.324Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted