CWE-1423
Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution
Monthly
Transient execution information disclosure in Intel processors allows unprivileged guest VM code to leak sensitive data from co-resident workloads by exploiting shared microarchitectural predictor state during VMX non-root operation. Confidentiality impact is rated high at both the vulnerable-system and subsequent-system level, indicating potential cross-VM or host-to-guest data leakage consistent with Spectre-class side-channel behavior. No public exploit has been identified at time of analysis, EPSS sits at the 3rd percentile, and CISA SSVC rates exploitation as none - but the cross-boundary confidentiality impact makes this relevant to any multi-tenant virtualized environment running affected Intel silicon.
Transient execution information disclosure in Intel processors allows unprivileged guest VM code to leak sensitive data from co-resident workloads by exploiting shared microarchitectural predictor state during VMX non-root operation. Confidentiality impact is rated high at both the vulnerable-system and subsequent-system level, indicating potential cross-VM or host-to-guest data leakage consistent with Spectre-class side-channel behavior. No public exploit has been identified at time of analysis, EPSS sits at the 3rd percentile, and CISA SSVC rates exploitation as none - but the cross-boundary confidentiality impact makes this relevant to any multi-tenant virtualized environment running affected Intel silicon.