Huawei Cloud Services discovered information leak vulnerabilities

Huawei discovered information leak vulnerabilities in Cloud Services and other related products. On December 23, Huawei released a security update to address vulnerabilities in cloud services and other related products. The products on the list should be upgraded as soon as possible.

Intel and security researchers previously disclosed three new processor-side channel vulnerabilities (CVE-2018-3615, CVE-2018-3620 and CVE-2018-3646). Successful exploitation of these vulnerabilities could allow local attackers to read the memory of other processes under certain conditions. The researchers called these vulnerabilities “Foresight” and “Prediction-NG”. They are also called L1 terminal faults (L1TF) in the industry.

Customers should contact the Huawei Technical Support Center (Huawei TAC) to request an upgrade.

For TAC contact information, please visit Huawei’s global website http://www.huawei.com/en/psirt/report-vulnerabilities.

Click on the source link for more detailed information. Source: Huawei

Vulnerability detail:
CVE-2018-3615, CVE-2018-3620, CVE-2018-36464 Vulnerability level: important

A system with a microprocessor that uses speculative execution and address translation can allow unauthorized disclosure of information in the L1 data cache to an attacker through local user access through terminal page errors and secondary channel analysis.