🟠 High | Source: GCP Compute Engine Security Bulletins
A previously disclosed Intel CPU vulnerability (CVE-2018-3646), affecting Skylake, Broadwell, and Haswell microarchitectures, has been revisited following new research into attack techniques not considered when the original mitigations were applied in 2018. The flaw allows an attacker to read sensitive data from the CPU’s L1 cache without authorisation, posing a cross-tenant data leakage risk in shared cloud environments. Google has applied updated fixes across Google Cloud infrastructure to address the residual risk.
Security Architect’s Take: No immediate customer action is required as Google has already applied mitigations at the infrastructure level, but architects running sensitive multi-tenant workloads on older Intel-based instance types should verify whether sole-tenant nodes or confidential computing options are warranted to further reduce residual hardware-level exposure.
Original advisory: GCP-2025-042