> Source: [sk122205](https://support.checkpoint.com/results/sk/sk122205) # sk122205 - Check Point Response to Intel Side Channel Attacks (Meltdown, Spectre, Foreshadow) (CVE-2017-5753, CVE-2017-5715, CVE-2017-5754, CVE-2018-3693, CVE-2018-3639, CVE-2018-3640, CVE-2018-3620, CVE-2018-3646, CVE-2018-3615) | Property | Value | |----------|-------| | Solution ID | sk122205 | | Date Created | 2018-01-03 | | Last Modified | 2022-07-18 | | Technical Level | General | ## Symptoms - * Researchers have released information about several vulnerabilities in Intel (and other) processors that allow access from user-space processes to kernel and/or other user-space processes. These are local privilege escalation attack vectors. For more information see: * * * On Jan 3rd, researchers released information about the following CVEs: CVE-2017-5753, CVE-2017-5715, CVE-2017-5754 * On May 21st, researchers released information about the following CVEs: CVE-2018-3639, CVE-2018-3640 * On August 14, 2018, Intel released information about the Side Channel L1 Terminal Fault (L1TF) vulnerability, aka Foreshadow (CVE-2018-3620, CVE-2018-3646). For more information see: * * * On 2022, the [CVE-2022-29901](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29901) was disclosed. ## Solution There is no added risk to Check Point appliances, since code execution privileges are to be provided to trusted administrators only. The analysis below is relevant to both findings (Jan 3rd and May 21st ). **Frequently Asked Questions (FAQ)** **Q1: What is a local privilege escalation attack?** A1: It is an attack vector where there is a local process that is able to access or run code that requires higher privilege or that wasn't supposed to be accessible at all. **Q2: Why is this less interesting in the case of Check Point appliances?** A2: Check Point appliances run various hardened operating systems, including GAiA, SecurePlatform, and IPSO. A user on this system is intended to be one that is trusted by the local administrator. Moreover, in order to run arbitrary programs one needs to have Expert access and in this case, is already with the highest possible permissions of the root user. **Note:** The verdict is the same for Open Servers installed with Check Point GAiA. **Q3: Is Check Point going to provide a patch?** A3: Check Point is working with the relevant parties to create a patch. As the attack vector is low severity on Check Point appliances, we'll provide a patch only after we gain confidence on its quality and performance impact. **Q4: Can malicious code being analyzed on Check Point TEX appliances or cloud service exploit these vulnerabilities against the appliance's operating system?** A4: No. A feature which is used in the exploit phase is disabled on our appliances. **Q5: How will this affect vSEC for Public Cloud running on different platforms?** **A5:** * **On AWS:** Check Point instances are not affected. * **On Azure:** Every Virtual Machine in Azure will be automatically rebooted (see this [link](https://azure.microsoft.com/en-us/blog/securing-azure-customers-from-cpu-vulnerability/) for more information). On a Single Gateway and a Management Server expect the standard reboot downtime. In a Cluster setup, this will cause a Cluster failover and a standard failover downtime. Since there is a 30 minutes period between maintenance for each Availability Set, only one Gateway in each Cluster will be rebooted at a time. **Q6: Is my Check Point gateway running on XOS vulnerable?** A6: X-Series Response from [Symantec/Crossbeam](https://www.symantec.com/security-center/network-protection-security-advisories/SA161) (09-Jan-2018) **Q7: Are Check Point SMB (Small and Medium Business) embedded systems running Linux vulnerable?** A7: SMB Appliances: * 1200R appliances are **not**vulnerable to any of the variants. * The 700 and 1400 appliance series are **not** vulnerable to Meltdown (variants 3 and 3a). Vulnerability to Spectre is currently under investigation. (**Note:** Variant 3 = Rogue data cache load (CVE-2017-5754). ARM has also included information on a related variant, known as 3a.) * The 600 and 1100 appliance series are not vulnerable to Meltdown and Spectre. SMB embedded systems running Linux are closed systems that do not allow running arbitrary code. Therefore, our assessment is that SMB appliances are not exposed to exploits based on the above vulnerabilities. We will continue to work closely with our SoC manufacturers to investigate these issues. When security patches will be available, we will assess code integration and fixes according to the security and performance impact. **Note:** A new IPS protection has been added for the Intel vulnerabilities. Refer to Check Point will update this article when more information comes in. **Related Solution:** * [sk122103 - Compatibility of Windows January 2018 Patch Tuesday Update with Endpoint Security Anti-Malware Blade](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk122103) * [sk122312 - Spectre \& Meltdown Vulnerabilities: What does it mean for your mobile devices?](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk122312) * [sk122296 - SandBlast Agent Advisory on Meltdown and Spectre](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk122296) --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content