CVE-2018-3615: high-severity vulnerability in Intel Corporation Multiple
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A security flaw in Intel processors with SGX allows a local attacker to steal secret data stored in the processor's L1 cache by observing timing patterns. This bypasses SGX's protection meant to isolate sensitive code.
CVE-2018-3615 exploits speculative execution combined with L1 data cache side-channel analysis to leak information from SGX enclaves. An attacker with local user access can infer enclave secrets through cache timing measurements; this requires the victim enclave to be running but no memory corruption or code execution within the enclave itself.
In the same product, most dangerous first.