Unrated severityNVD Advisory· Published Aug 22, 2018· Updated Aug 5, 2024
CVE-2018-10846
CVE-2018-10846
Description
A cache-based side channel in GnuTLS implementation that leads to plain text recovery in cross-VM attack setting was found. An attacker could use a combination of "Just in Time" Prime+probe attack in combination with Lucky-13 attack to recover plain text using crafted packets.
Affected products
16- osv-coords16 versionspkg:rpm/opensuse/gnutls&distro=openSUSE%20Tumbleweedpkg:rpm/suse/gnutls&distro=SUSE%20Enterprise%20Storage%204pkg:rpm/suse/gnutls&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3pkg:rpm/suse/gnutls&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2011%20SP4pkg:rpm/suse/gnutls&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015pkg:rpm/suse/gnutls&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015pkg:rpm/suse/gnutls&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSSpkg:rpm/suse/gnutls&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCLpkg:rpm/suse/gnutls&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSSpkg:rpm/suse/gnutls&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3pkg:rpm/suse/gnutls&distro=SUSE%20Linux%20Enterprise%20Server%2012-LTSSpkg:rpm/suse/gnutls&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1pkg:rpm/suse/gnutls&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2pkg:rpm/suse/gnutls&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3pkg:rpm/suse/gnutls&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3pkg:rpm/suse/gnutls&distro=SUSE%20OpenStack%20Cloud%207
< 3.7.2-1.2+ 15 more
- (no CPE)range: < 3.7.2-1.2
- (no CPE)range: < 3.2.15-18.6.1
- (no CPE)range: < 3.3.27-3.3.1
- (no CPE)range: < 2.4.1-24.39.76.1
- (no CPE)range: < 3.6.2-6.3.1
- (no CPE)range: < 3.6.2-6.3.1
- (no CPE)range: < 3.2.15-18.6.1
- (no CPE)range: < 3.2.15-18.6.1
- (no CPE)range: < 3.2.15-18.6.1
- (no CPE)range: < 3.3.27-3.3.1
- (no CPE)range: < 3.2.15-18.6.1
- (no CPE)range: < 3.2.15-18.6.1
- (no CPE)range: < 3.2.15-18.6.1
- (no CPE)range: < 3.3.27-3.3.1
- (no CPE)range: < 3.3.27-3.3.1
- (no CPE)range: < 3.2.15-18.6.1
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
10- access.redhat.com/errata/RHSA-2018:3050mitrevendor-advisoryx_refsource_REDHAT
- access.redhat.com/errata/RHSA-2018:3505mitrevendor-advisoryx_refsource_REDHAT
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ILMOWPKMTZAIMK5F32TUMO34XCABUCFJ/mitrevendor-advisoryx_refsource_FEDORA
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WDYY3R4F5CUTFAMXH2C5NKYFVDEJLTT7/mitrevendor-advisoryx_refsource_FEDORA
- usn.ubuntu.com/3999-1/mitrevendor-advisoryx_refsource_UBUNTU
- www.securityfocus.com/bid/105138mitrevdb-entryx_refsource_BID
- bugzilla.redhat.com/show_bug.cgimitrex_refsource_CONFIRM
- eprint.iacr.org/2018/747mitrex_refsource_MISC
- gitlab.com/gnutls/gnutls/merge_requests/657mitrex_refsource_CONFIRM
- lists.debian.org/debian-lts-announce/2018/10/msg00022.htmlmitremailing-listx_refsource_MLIST
News mentions
0No linked articles in our index yet.