Rapid7 Vulnerability & Exploit Database

Microsoft CVE-2017-5753: Guidance to mitigate speculative execution side-channel vulnerabilities

Free InsightVM Trial No Credit Card Necessary
2024 Attack Intel Report Latest research by Rapid7 Labs
Back to Search

Microsoft CVE-2017-5753: Guidance to mitigate speculative execution side-channel vulnerabilities

Severity
5
CVSS
(AV:L/AC:M/Au:N/C:C/I:N/A:N)
Published
01/03/2018
Created
07/25/2018
Added
02/01/2018
Modified
11/18/2021

Description

Microsoft is aware of a new publicly disclosed class of vulnerabilities referred to as 'speculative execution side-channel attacks' that affect many modern processors and operating systems including Intel, AMD, and ARM. Note: this issue will affect other systems such as Android, Chrome, iOS, MacOS, so we advise customers to seek out guidance from those vendors. An attacker who successfully exploited these vulnerabilities may be able to read privileged data across trust boundaries. In shared resource environments (such as exists in some cloud services configurations), these vulnerabilities could allow one virtual machine to improperly access information from another. In non-browsing scenarios on standalone systems, an attacker would need prior access to the system or an ability to run code on the system to leverage these vulnerabilities. Microsoft has released updates to help mitigate these vulnerabilities. To get all available protections, firmware (microcode) and software updates are required. This may include microcode from device OEMs and in some cases updates to AV software as well. In some cases, installing these updates will have a performance impact. We have also taken action to secure our cloud services. Microsoft has no information to indicate that these vulnerabilities have been used to attack customers at this time. Microsoft continues working closely with industry partners including chip makers, hardware OEMs, and app vendors to protect customers. Please review Microsoft Security Advisory ADV180002 for more details.

Solution(s)

  • msft-kb4057113-aabc5156-cae2-44bf-aa69-a904626118fa-x64-adv180002-cve-2017-5753
  • msft-kb4057113-aabc5156-cae2-44bf-aa69-a904626118fa-x86-adv180002-cve-2017-5753
  • msft-kb4057114-0aa653a1-1459-44cd-be0b-0fcb77e4ef85-x64-adv180002-cve-2017-5753
  • msft-kb4057114-0aa653a1-1459-44cd-be0b-0fcb77e4ef85-x86-adv180002-cve-2017-5753
  • msft-kb4057115-ffc4140f-5e49-4bf1-810c-0a5ee4de8952-x64-adv180002-cve-2017-5753
  • msft-kb4057115-ffc4140f-5e49-4bf1-810c-0a5ee4de8952-x86-adv180002-cve-2017-5753
  • msft-kb4057116-c50042e5-81bf-449e-9623-a15b4bb82a6b-x64-adv180002-cve-2017-5753
  • msft-kb4057116-c50042e5-81bf-449e-9623-a15b4bb82a6b-x86-adv180002-cve-2017-5753
  • msft-kb4057117-2b3b7670-ca19-4d85-8e63-ba3c020706f7-x64-adv180002-cve-2017-5753
  • msft-kb4057117-2b3b7670-ca19-4d85-8e63-ba3c020706f7-x86-adv180002-cve-2017-5753
  • msft-kb4057118-31aaf88a-a261-4c62-9d76-590998a4e1fb-x64-adv180002-cve-2017-5753
  • msft-kb4057120-40e14331-2f87-4618-b57c-c29895b3cd23-x64-adv180002-cve-2017-5753
  • msft-kb4057120-40e14331-2f87-4618-b57c-c29895b3cd23-x86-adv180002-cve-2017-5753
  • msft-kb4057121-70870a56-6634-4591-bd88-1f359c15573f-x64-adv180002-cve-2017-5753
  • msft-kb4057121-70870a56-6634-4591-bd88-1f359c15573f-x86-adv180002-cve-2017-5753
  • msft-kb4057122-ab85e1ed-57da-4f4c-a32d-2f009b8ed13a-x64-adv180002-cve-2017-5753
  • msft-kb4058559-2d53d730-21e6-49d9-9cf3-99233642e3a2-x64-adv180002-cve-2017-5753
  • msft-kb4058560-f62990a4-1dbf-4f29-babd-180695f39730-x64-adv180002-cve-2017-5753
  • msft-kb4058561-23eeaa61-3918-4fad-b602-1363cbcf3474-x64-adv180002-cve-2017-5753
  • msft-kb4058562-d103b35a-545c-4789-a435-9edd27704648-x64-adv180002-cve-2017-5753
  • msft-kb4103723-54f93c06-1d96-40f5-bdc8-f9924dbcd522
  • microsoft-windows-windows_server_2016-1607-kb4103723
  • msft-kb4103723-a74a9c4e-0823-4afc-8b58-cf1785a2e2b4

References

View more

insightVM

Advanced vulnerability management analytics and reporting.
Key Features
  • Lightweight Endpoint Agent
  • Live Dashboards
  • Real Risk Prioritization
  • IT-Integrated Remediation Projects
  • Cloud, Virtual, and Container Assessment
  • Integrated Threat Feeds
  • Easy-to-Use RESTful API
  • Automation-Assisted Patching
  • Automated Containment
Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;