0

We use Web Application deployed on a CentOS server.

Can the attack will be performed via a browser? Or the attacker need a physical access to the CentOS server?

I cannot understand the attack vector from the RHEL: https://access.redhat.com/security/vulnerabilities/ssbd

A malicious, unprivileged user could use this flaw to read privileged system memory and/or memory outside of a sandboxed environment like a web-browser or JIT execution run times.

2

Can the attack will be performed via a browser? Or the attacker need a physical access to the CentOS server?

The attacker needs local access to the system. This does not necessarily mean physical access but it can also be some kind of remote access which allows the attacker to execute code on the system. This could for example be a security issue in your web application which allows remote code execution (RCE).

If you have such a vulnerability which allows RCE it is very likely that the attacker will not try to use a very hard to execute attack like Speculative Store Bypass or any other Spectre variant but that he will make use of some easier to exploit security issues which are often available on a complex system. In other words: don't worry too much about this issue since it is (currently) very hard to exploit but worry more about the other issues you might have.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.