Advisories

6 min read

Here we publish the descriptions of vulnerabilities that Deutsche Telekom’s pentesters have found in the context of tests of solutions Deutsche Telekom uses. All weaknesses are only published with the consent of the affected parties after the vulnerability has been corrected (Responsible Disclosure). We also publish technical comments and important CERT Advisories.

Overview

5 Jan 2018

By misuse of several processor bugs it is possible to break up the separation between the kernel and user space.

Deutsche Telekom CERT Assessment

On Intel CPU driven platforms, it is possible for normal user programs to gather information about protected kernel memory areas (“Meltdown attack”, CVE-2017-5754) [1] [2]. This results in an information leakage between kernel and user space.

This vulnerability affects every Intel CPU produced in the past decade (CPUs since 1995 except Itanium and pre-2013 Atoms). The in [3] listed ARM cores are also affected by this vulnerability.

A further issue is described in the “Spectre attack” (CVE-2017-5753 and CVE-2017-5715). Spectre allows a user-mode application to extract information from other processes or VMs to access memory of other VMs. This vulnerability affects all listed Intel CPUs, as well as AMD’s Ryzen, FX and Pro families and several ARM Cortex cores listed in [3].

Official disclosure for Spectre and Meltdown took place on 2018-01-04 [10].

To exploit both vulnerabilities an attacker needs to be able to execute code on the target machine.

Thus, up to now network components like routers, switches, firewalls, mobiles or CPEs don’t provide enough attack surface for exploitation even if they are affected. On most network components it is very difficult to run attacker crafted code because they’ve never been designed to run custom code.

Recommendations

Apply patches as soon as they are available from the respective supplier
(for Microsoft desktop systems check availability with AV vendors [13])
Top priority should be patching of (see timeline below)
o   hypervisors of cloud systems
o   operating systems of desktop clients and virtual/remote desktop systems
o   operating systems of hosting platforms
On XEN hypervisors:
o Enable “supervisor mode execute protection” if possible
o Evaluate if XEN VMs can be run in HVM or PVM mode (only PV hosting hypervisors are affected)
For network components
o Even if an attack is unlikely ask your vendor if your device is vulnerable and needs patching

Patch Prioritization

In general high priority patching is advised for every machine which runs untrusted code from third parties. On shared and exclusive private clouds there is less risk because these platforms are dedicated to trusted customers. On all other servers it is unlikely that an attacker is able to run arbitrary code. Patch your system based on local patch cycles.

Due to the complexity of the attack it is unlikely that smartphones get exploited.

Patch Availability

Microsoft Windows 7 SP1, 8.1, 10 [5]
o   McAfee is now patch compatible [12]
o   Further AV vendors can be found in [13]
o   A registry key has to be set. Without the key the client doesn’t fetch the update. See [5].
Microsoft Windows Server 2008 R2, Server 2012 R2, Server 2016, Server Version 1709 Attention: The mitigation has to be enabled via registry [6]
Mac OS X 10.13.1 (10.13.2 isn’t vulnerable)
Several Suse Linux and RHEL distributions [7] [8]
VMware ESXi 5.5 to 6.5, Workstation 12.X and 14.X, Fusion 8.X [9]
Android (patchlevel 2018-01-05)
iOS (patchlevel 11.2)

Linux Kernel patches will be most probably available on 2018-01-09.

IBM AIX patches will be most probably available on 2018-01-12 [11].

There is no announcement for a SOLARIS patch, we are in touch with Oracle.