Thank You, threat is real !
Microsoft released an update and a fix.
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180002
I also opened a Cisco TAC and they replied to me acknowledging the threat, there is a bug CSCvh32210 for that, but not yet announced / made external.
Cisco is aware of recently published security research related to speculative execution in modern CPU architectures. Our team is following our well-established process to investigate all aspects of the issue and evaluate any potential impact on Cisco products. If something new is found that our customers need to be aware of and respond to, we will share it through our established PSIRT disclosure processes.
I can share the below information with you :
|
CVE-2017-5715 - Branch Target Injection AKA Spectre
- Cause by Speculative Execution Algorithms
- Requires the attacker to execute code on the affected platform
- Attacker Infers data by performing timing attacks on the CPU Cache Pipeline
- Affected platform: Intel, AMD or ARM
- Remediation:
- Requires uCode update to the CPU - Delivered by BIOS on devices that have upgradeable CPUs
- Requires changes to the Kernel of the operating system
CVE-2017-5753 - Bounds Check Bypass AKA Spectre
- Cause by Speculative Execution Algorithms
- Requires the attacker to execute code on the affected platform
- Attacker Infers data by performing timing attacks on the CPU Cache Pipeline
- Affected platform: Intel, AMD or ARM
- Remediation:
- Requires update to Kernel of operating systems
CVE-2017-5754 - Rogue Data Cache Load AKA Meltdown
- Cause by Speculative Execution Algorithms
- Requires the attacker to execute code on the affected platform
- Attacker Infers data by performing timing attacks on the CPU Cache Pipeline
- Affected platform: successfully proved only on Intel
- Remediation:
- Requires update to Kernel of operating systems
|
There is a bug filed for the same: CSCvh32210
This is yet to be externalized.
