OVH - Spectre Variant 4 and 3a disclosure

Along with the rest of the IT industry, OVH was made aware of some specific security vulnerabilities ("Spectre variant 4" and "Spectre Variant 3a") concerning certain processor architectures, affecting Intel products but maybe other CPU vendors. Two of these vulnerabilities make it possible to carry out side-channel attacks, based on the same kind of mechanism as a previous vulnerability disclosed in January 2018 named “Spectre” (CVE-2017-5753 and CVE-2017-5715).  

Stemming from Spectre

  These vulnerabilities are variants of "Spectre" and are called “Spectre Variant 3a” (CVE-2018-3640), and “Spectre Variant 4” (CVE-2018-3639), both also know as “SpectreNG” or “Spectre New Generation”. The specific “Spectre Variant 4” is also referred as “Speculative Store Bypass”. Though they are closely related to "Spectre", they have enough difference to be considered specific flaws which will require additional action(s) for certain CPU architectures. Spectre Variant 3a concern systems with microprocessors utilizing speculative execution and that perform speculative reads of system registers, which may allow unauthorized disclosure of system parameters to an attacker with local user access via a side-channel analysis. Spectre Variant 4 concern systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known, which may allow unauthorized disclosure of information to an attacker with local user access through a side-channel analysis. We also know that Spectre Variant 4 may be carried out in a language-based runtime environment. The most common use of runtime is JavaScript, which is used in web browsers but at this time we are not aware of any successful web browser exploitation.  

OVH closely monitor the situation

  Once made aware of these vulnerabilities, OVH immediately mobilized its teams to clearly understand the implication of these flaws, evaluate risks, and develop an action plan to secure its infrastructures as well as determine the best course of action for its customers. We will communicate in the coming hours a list of all concerned OVH product and services with the relative actions launched and planned by OVH, and actions needed on customers side to protect their infrastructures. Mitigation of these flaws will need an addition of CPU microcode and software/operating system updates. As usual, we will continue to test every microcode or sensible update internally before deploying anything live, to ensure the security and the stability of our customers infrastructure. From a SysAdmin point of view, we also strongly suggest to monitor operating system and hypervisor updates and keep theses systems up-to-date. For individual customers, we put as a reminder that since January 2018, all major web browsers have been patched to mitigate Spectre Variant 1 in their managed runtimes. These patches make it more difficult to exploit side channel attacks via a web browser and we can assume that these patches, to some degree, could be applicable to Variant 4. With the current level of information available, OVH strongly urges its individual customers and public to verify and keep their web browser(s) up-to-date. In a more global manner, we are actively and closely working with Intel, our partners and manufacturers on this topic and we are currently investigating potential risks represented by these flaws. We will keep you informed in real time of any information that we receive and will apply any potential security measures on the services concerned. As always, we will also keep our customers and public informed about any corrective actions required on their side to reduce their machines and/or infrastructures exposure.