CVE-2018-12127
Public on 2019-05-07
Modified on 2019-08-27
Description
Microprocessors use a ‘load port’ subcomponent to perform load operations from memory or IO. During a load operation, the load port receives data from the memory or IO subsystem and then provides the data to the CPU registers and operations in the CPU’s pipelines. Stale load operations results are stored in the 'load port' table until overwritten by newer operations. Certain load-port operations triggered by an attacker can be used to reveal data about previous stale requests leaking data back to the attacker via a timing side-channel.
Severity
CVSS v3 Base Score
See breakdown
Affected Packages
Platform | Package | Release Date | Advisory | Status |
---|---|---|---|---|
Amazon Linux 1 | kernel | 2019-05-07 | ALAS-2019-1205 | Fixed |
Amazon Linux 2 - Core | kernel | 2019-05-07 | ALAS2-2019-1205 | Fixed |
Amazon Linux 2 - Core | libvirt | 2019-08-23 | ALAS2-2019-1274 | Fixed |
Amazon Linux 1 | qemu-kvm | 2019-08-07 | ALAS-2019-1260 | Fixed |
CVSS Scores
Score Type | Score | Vector | |
---|---|---|---|
Amazon Linux | CVSSv3 | 6.5 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
NVD | CVSSv2 | 4.7 | AV:L/AC:M/Au:N/C:C/I:N/A:N |
NVD | CVSSv3 | 5.6 | CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N |