Intel

CVE-2022-40982

Offenlegung von Informationen durch den Mikroarchitekturzustand nach vorübergehender Ausführung in bestimmten Vektor-Ausführungseinheiten…

mediumEPSS 3.1%

Description

A Gather Data Sampling (GDS) transient execution side-channel vulnerability was found affecting certain Intel processors. This issue may allow a local attacker using gather instruction (load from memory) to infer stale data from previously used vector registers on the same physical core.

Source: redhat_csafsuse_csafcvelistv5

Metrics

XIEM Effective CVSS
6.5
Source: cna-v3
EPSS percentile
87.2 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
KEV status
—
Show all metrics
Severity
medium
Priority score
96.62
Exploit maturity
no public PoC known
CVSS v3
6.5
EPSS score
3.1 %
Moderate — model estimates 1-10% exploitation likelihood.
Published
2023-08-11 02:37 UTC
CWE
CWE-1342

Weakness classes (CWE)

  • CWE-1342Base

    Information Exposure through Microarchitectural State after Transient Execution

    The processor does not properly clear microarchitectural state after incorrect microcode assists or speculative execution, resulting in transient execution.

    cwe.mitre.org →

References & sources

Linked advisories