Speculative Execution Side-Channel Vulnerabilities (CVE-2018-3615, CVE-2018-3620, and CVE-2018-3646): Impact on RSA products

000036619

000036619

RSA is aware of a recently disclosed class of CPU speculative execution vulnerabilities (CVE-2018-3615, CVE-2018-3620, and CVE-2018-3646) known collectively as "L1 Terminal Fault" (L1TF) that affect Intel microprocessors. For more information on these vulnerabilities, please review the security advisory posted by Intel.

RSA is investigating the impact of these vulnerabilities on our products and we are working with Intel and other industry partners to mitigate these vulnerabilities. Mitigation steps may vary by product and may include updates to firmware, operating system, and hypervisor components.

RSA recommends customers follow security best practices for malware protection to help prevent possible exploitation of these vulnerabilities until any future updates can be applied. These practices include, but are not limited to, promptly deploying software updates, avoiding unknown hyperlinks and websites, never downloading files or applications from unknown sources, and employing up-to-date anti-virus and advanced threat protection solutions.

For information on other Dell products, please refer to the following link:  http://www.dell.com/support/L1-terminal-fault

• Intel: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00161.html
• Microsoft: https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/adv180018
• RedHat: https://access.redhat.com/security/vulnerabilities/L1TF
• SuSe: https://www.suse.com/c/suse-addresses-the-l1-terminal-fault-issue/
• Ubuntu: https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/L1TF
• VMWare: https://kb.vmware.com/kb/55636

 
Note 1: It is a software product only. Reported vulnerabilities are best mitigated via firmware and operating system updates. Customers are strongly advised to patch their host systems where the product is installed.

Note 2: To take advantage of these vulnerabilities, an attacker first must be able to run malicious code on the targeted system. The product is designed to prevent users from loading and executing any external and/or untrusted code on the system. The reported issues do not introduce any additional security risk to the product.

Note 3: ​To take advantage of these vulnerabilities, an attacker first must be able to run malicious code on the targeted system. Access to the product to load external and/or potentially untrusted code is restricted to users with root or root-equivalent privileges only. The reported issues do not introduce any additional security risk to the product, provided the recommended best practices to protect the access of highly privileged account are followed.

For information on other Dell products, please see  http://www.dell.com/support/L1-terminal-fault