CVE-2024-28956 is a speculative execution vulnerability identified in Intel Cascade Lake and Ice Lake processors, related to same-mode Indirect Target Selection (ITS). Google has implemented fixes on its cloud assets to mitigate this vulnerability, and Intel OEMs along with operating system partners are working on additional mitigations. The vulnerability has a CVSS 4.0 score of 5.7, indicating medium severity. No evidence of exploitation has been found. The mitigations may cause performance impacts on long-running third-generation or later virtual machines after OS-level patches are applied.

The vulnerability could allow information disclosure via speculative execution side channels on affected Intel processors. However, no exploitation has been observed or reported. Mitigations have been applied in Google Cloud environments, and further OS-level mitigations will be deployed. Performance degradation is a possible side effect of these mitigations on certain virtual machines.

Google has already applied mitigations to its cloud infrastructure, and no customer action is required at this time. Intel OEMs and operating system partners will release additional mitigations, which should be applied when available. Customers should monitor vendor advisories for updates. Be aware that applying these mitigations may result in some performance degradation on long-running VMs.