Medium severity · published Mar 15, 2024
CVE-2024-2193
Speculative Race Condition impacts modern CPU architectures that support speculative execution, also known as GhostRace.
5.7
CVSS
1.3%
EPSS
No
On KEV
Description
A Speculative Race Condition (SRC) vulnerability that impacts modern CPU architectures supporting speculative execution (related to Spectre V1) has been disclosed. An unauthenticated attacker can exploit this vulnerability to disclose arbitrary data from the CPU using race conditions to access the speculative executable code paths.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Attack vector
Local
Complexity
High
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-2193
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-2193
www.openwall.com
http://www.openwall.com/lists/oss-security/2024/03/12/14
download.vusec.net
https://download.vusec.net/papers/ghostrace_sec24.pdf
git.kernel.org
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/?id=944d5fe50f3f03daacfea16300e656a1691c4a23
ibm.github.io
https://ibm.github.io/system-security-research-updates/2024/03/12/ghostrace
kb.cert.org
https://kb.cert.org/vuls/id/488902
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EIUICU6CVJUIB6BPJ7P5QTPQR5VOBHFK/
More from CPU
4.0
CVE-2021-26400
AMD processors may speculatively re-order load instructions which can result in stale data being observed when multiple processors are operating on shared memory, resulting in…