On August 8th, 2023, Intel disclosed a vulnerability in its recent computer processor microarchitecture. This vulnerability, known as "Gather Data Sampling (GDS)" or "Downfall", may allow an attacker to obtain sensitive information from a system. This vulnerability is assigned CVE ID as CVE-2022-40982 and has been given a medium severity by Intel.

What is the vulnerability?

CVE-2022-40982 is a transient execution side-channel vulnerability that affects Intel® Core processors from the 6th Generation (Skylake) to the 11th Generation (Tiger Lake). It allows an attacker with local access to infer stale data from previously used vector registers on the same physical core. A detailed description can be found in the “Downfall: Exploiting Speculative Data Gathering” paper.

What is the risk?

If an attacker is able to exploit this vulnerability, they could potentially exfiltrate information contained within different security contexts (i.e., other virtual machines or even the host device).

What has IONOS Cloud done?

IONOS Cloud is committed to the privacy and security of our customers' data. We are aware of this vulnerability and have already initiated the required steps to mitigate this vulnerability. We are also investigating the exposure and risk of this vulnerability for our customer’s products and instances.

We will provide necessary updates as we learn more.

How can I get help?

If you have further questions or concerns about this vulnerability, please contact our customer support team.

The Vulnerability Register reports security vulnerabilities affecting IONOS Cloud products and services. The information provided is part of an ongoing effort to help you manage security risks and protect your systems.

We highly recommend using the NIST (National Institute of Standards and Technology) public vulnerability database as an invaluable resource for your security efforts. The NIST public vulnerability database provides comprehensive information on known vulnerabilities, including detailed descriptions, severity ratings, and mitigation strategies.

For third-party dependant assets and services provided by IONOS Cloud, we recommend that you closely monitor the below external resources for the latest security-related information.

Compute Engine

Managed Services

To stay informed about the latest security vulnerabilities affecting various software, operating systems, and network components, regularly monitoring and referencing the above resources are crucial. By doing so, you can proactively assess and address potential security risks within your infrastructure.