CVE-2018-9056 — hw: cpu: speculative execution branch predictor side-channel attack

Back Back to CVE browser

MEDIUM

hw: cpu: speculative execution branch predictor side-channel attack

Published Mar 27, 2018

5.6

MEDIUM

CVSS 3.0

EPSS 0.67%

Description

Systems with microprocessors utilizing speculative execution may allow unauthorized disclosure of information to an attacker with local user access via a side-channel attack on the directional branch predictor, as demonstrated by a pattern history table (PHT), aka BranchScope.

Affected products

Red Hat Enterprise Linux 5

kernel

Not affected
Red Hat Enterprise Linux 6

kernel

Not affected
Red Hat Enterprise Linux 7

kernel

Not affected
Red Hat Enterprise Linux 7

kernel-alt

Not affected
Red Hat Enterprise Linux 7

kernel-rt

Not affected
Red Hat Enterprise Linux 8

kernel

Not affected
Red Hat Enterprise MRG 2

realtime-kernel

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 5	kernel	Not affected	n/a
Red Hat Enterprise Linux 6	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel-alt	Not affected	n/a
Red Hat Enterprise Linux 7	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 8	kernel	Not affected	n/a
Red Hat Enterprise MRG 2	realtime-kernel	Not affected	n/a

Remediation

Red Hat mitigation

This is a hardware processor issue, not a Linux kernel flaw. The flaw specifically targets software which uses sensitive information in branching expressions. A software mitigation could be for the target software to avoid the use of sensitive data bits in (if..else) branching decisions or to avoid (if..else) branching altogether.

Metrics

0.67% 0.00672

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00672

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Table of values (9 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.67% (0.00672)	50.28th	v5 (v2026.06.15)
Sep 20, 2026	0.67% (0.00672)	50.62th	v5 (v2026.06.15)
Jul 20, 2024	0.05% (0.00051)	20.30th	v3 (v2023.03.01)
Jun 12, 2024	0.05% (0.00051)	19.67th	v3 (v2023.03.01)
Mar 7, 2023	0.05% (0.00051)	17.65th	v3 (v2023.03.01)
Mar 6, 2023	1.10% (0.01102)	53.65th	v2 (v2022.01.01)
Feb 4, 2022	1.00% (0.01005)	17.93th	v2 (v2022.01.01)
Feb 3, 2022	0.58% (0.00584)	13.34th	v5 (v2026.06.15)
Apr 14, 2021	0.58% (0.00584)	0.00th	v1

Weaknesses (2)

CWE-200

Exposure of Sensitive Information

CWE-226

References (6)

http://www.cs.ucr.edu/~nael/pubs/asplos18.pdf
x_refsource_MISCExploitThird Party Advisory
https://access.redhat.com/security/cve/CVE-2018-9056
Vendor Advisory
https://arstechnica.com/gadgets/2018/03/its-not-just-spectre-researchers-reveal-more-branch-prediction-attacks/
x_refsource_MISCThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1561794
Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2018-9056
https://www.cve.org/CVERecord?id=CVE-2018-9056

Link	Providers	Tags
http://www.cs.ucr.edu/~nael/pubs/asplos18.pdf		x_refsource_MISCExploitThird Party Advisory
https://access.redhat.com/security/cve/CVE-2018-9056		Vendor Advisory
https://arstechnica.com/gadgets/2018/03/its-not-just-spectre-researchers-reveal-more-branch-prediction-attacks/		x_refsource_MISCThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1561794		Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2018-9056
https://www.cve.org/CVERecord?id=CVE-2018-9056