Security Notice - Statement About the Side Channel Vulnerability "L1TF" of Chips
- Initial Release Date: 2018-08-15
- Last Release Date: 2018-08-15
Huawei noted that Intel and security researchers had disclosed three new side channel vulnerabilities (CVE-2018-3615, CVE-2018-3620, and CVE-2018-3646). Successful exploit of these vulnerabilities could allow a local attacker to read the memory of other processes in specific situations. These vulnerabilities are named by researchers as "Foreshadow" and "Foreshadow-NG". They are also known as L1 Terminal Fault (L1TF) in the industry.
Huawei has released a Security Advisory (SA) at https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180815-01-cpu-en.
The investigation is still ongoing. Huawei PSIRT will keep updating the SN. Please stay tuned.
Customers should contact Huawei TAC (Huawei Technical Assistance Center) to get necessary support for product security vulnerabilities. For TAC contact information, please refer to Huawei worldwide website at: http://www.huawei.com/en/psirt/report-vulnerabilities.
Huawei adheres to protecting the ultimate interests of users with best efforts and the principle of responsible disclosure and deal with product security issues through our response mechanism.
To enjoy Huawei PSIRT services and obtain Huawei product vulnerability information, please visit http://www.huawei.com/en/psirt.
To report a security vulnerability in Huawei products and solutions, please send it to PSIRT@huawei.com. For details, please visit http://www.huawei.com/en/psirt/report-vulnerabilities.
Customers should contact Huawei TAC (Huawei Technical Assistance Center) to get necessary support for product security vulnerabilities. For TAC contact information, please refer to Huawei worldwide website at: http://www.huawei.com/en/psirt/report-vulnerabilities.
2018-08-15 V1.0 INITIAL
[1] Intel：https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00161.html
[2] Micorsoft： https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180018
[3] Oracle：https://blogs.oracle.com/oraclesecurity/intel-l1tf
[4] Redhat：https://access.redhat.com/security/vulnerabilities/L1TF
[5] Linux Kernel：https://lore.kernel.org/patchwork/patch/974303/
