CVE-2018-10846

Impact:
Moderate
Public Date:
2018-08-21
CWE:
CWE-385
Bugzilla:
1582574: CVE-2018-10846 gnutls: "Just in Time" PRIME + PROBE cache-based side channel attack can lead to plaintext recovery
A cache-based side channel attack was found in the way GnuTLS implements CBC-mode cipher suites. An attacker could use a combination of "Just in Time" Prime+probe and Lucky-13 attacks to recover plain text in a cross-VM attack scenario.

Find out more about CVE-2018-10846 from the MITRE CVE dictionary dictionary and NIST NVD.

CVSS v3 metrics

CVSS3 Base Score 5.3
CVSS3 Base Metrics CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
Attack Vector Local
Attack Complexity High
Privileges Required Low
User Interaction Required
Scope Changed
Confidentiality High
Integrity Impact None
Availability Impact None

Red Hat Security Errata

Platform Errata Release Date
Red Hat Enterprise Linux 7 (gnutls) RHSA-2018:3050 2018-10-30

Affected Packages State

Platform Package State
Red Hat Enterprise Linux 6 gnutls Will not fix
Red Hat Enterprise Linux 5 gnutls Will not fix

External References

Last Modified
Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.