CacheOut, a New Speculative Execution Vulnerability

A research paper detailing a new speculative execution vulnerability called CacheOut was published today, but the difference with CacheOut is that the attacker could select the data they’re looking for rather than collecting everything from a CPU’s cache.

While this vulnerability is impressive, the complexity and effectiveness required diminishes the likelihood and feasibility of an attack.

Intel has released an advisory for the CVEs associated CacheOut (CVE-2020-0549 and CVE-2020-0548). Intel has given CacheOut a CVSS rating of 6.5 (Medium).

Tenable expects similar vendor response with patches and updates like we saw with ZombieLoad, and we will likely have detection plugins available after OS vendors have released their patches.