NetSight
IP …
medium5.6

CVE-2018-10846

A cache-based side channel in GnuTLS implementation that leads to plain text recovery in cross-VM attack setting was found.

Impact

A cache-based side channel in GnuTLS implementation that leads to plain text recovery in cross-VM attack setting was found. An attacker could use a combination of "Just in Time" Prime+probe attack in combination with Lucky-13 attack to recover plain text using crafted packets.

Affected products

VendorProductAffected versions
GnuGnutls
before 3.6.12
RedhatEnterprise Linux Desktop
Version 7.0
RedhatEnterprise Linux Server
Version 7.0
RedhatEnterprise Linux Workstation
Version 7.0
CanonicalUbuntu Linux
Versions 16.04, 18.04, 18.10, 19.04
FedoraprojectFedora
Versions 31, 32
DebianDebian Linux
Version 8.0

Weakness classification

CWE-385CWE-327

References