CVE-2023-38575
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2023-38575 is a medium-severity Non-Transparent Sharing of Microarchitectural Resources (CWE-1303) vulnerability in Intel (inferred from references). Its CVSS base score is 5.5 (Medium).
Operationally, ranked at the 19th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-32 (System Partitioning) and SC-49 (Hardware-enforced Separation and Policy Enforcement) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-42374
Vulnerability Data
Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Hardware-enforced separation mechanisms can structurally prevent non-transparent sharing of microarchitectural resources across contexts.
Partitioning the system into separate domains directly addresses isolation failures caused by shared hardware structures.
Security engineering principles applied during design can require explicit isolation of microarchitectural resources.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Runtime monitoring of hardware can detect anomalous cache/branch behavior caused by the weakness.
Hardware authenticity/integrity assessment before acquisition can identify and avoid CPUs with unsafe microarchitectural sharing.
Replacing hardware that lacks needed security capabilities directly targets CPUs whose shared resources violate isolation.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure system architecture principles can mandate hardware-level isolation of microarchitectural resources.
Security testing can detect side-channel leakage but does not prevent the underlying microarchitectural sharing.
Secure coding can avoid software patterns that amplify microarchitectural side-channels but does not address the hardware sharing itself.