Lucene search

K
archlinuxArchLinuxASA-202006-10
HistoryJun 13, 2020 - 12:00 a.m.

[ASA-202006-10] intel-ucode: information disclosure

2020-06-1300:00:00
security.archlinux.org
40

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

2.1 Low

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

19.4%

Arch Linux Security Advisory ASA-202006-10

Severity: High
Date : 2020-06-13
CVE-ID : CVE-2020-0543 CVE-2020-0548 CVE-2020-0549
Package : intel-ucode
Type : information disclosure
Remote : No
Link : https://security.archlinux.org/AVG-1187

Summary

The package intel-ucode before version 20200609-1 is vulnerable to
information disclosure.

Resolution

Upgrade to 20200609-1.

pacman -Syu “intel-ucode>=20200609-1”

The problems have been fixed upstream in version 20200609.

Workaround

None.

Description

  • CVE-2020-0543 (information disclosure)

A new domain bypass transient execution attack known as Special
Register Buffer Data Sampling (SRBDS) has been found. This flaw allows
data values from special internal registers to be leaked by an attacker
able to execute code on any core of the CPU. An unprivileged, local
attacker can use this flaw to infer values returned by affected
instructions known to be commonly used during cryptographic operations
that rely on uniqueness, secrecy, or both.

  • CVE-2020-0548 (information disclosure)

A flaw was found in Intel processors where a local attacker is able to
gain information about registers used for vector calculations by
observing register states from other processes running on the system.
This results in a race condition where store buffers, which were not
cleared, could be read by another process or a CPU sibling. The highest
threat from this vulnerability is data confidentiality where an
attacker could read arbitrary data as it passes through the processor.

  • CVE-2020-0549 (information disclosure)

A microarchitectural timing flaw was found on some Intel processors. A
corner case exists where data in-flight during the eviction process can
end up in the “fill buffers” and not properly cleared by the MDS
mitigations. The fill buffer contents (which were expected to be blank)
can be inferred using MDS or TAA style attack methods to allow a local
attacker to infer fill buffer values.

Impact

A local unprivileged attacker with access to an affected CPU can read
protected memory through a shared buffer on an SGX enclave or CPU core.

References

https://software.intel.com/security-software-guidance/insights/deep-dive-special-register-buffer-data-sampling
https://blogs.intel.com/technology/2020/06/ipas-security-advisories-for-june-2020/#gs.6uyhri
https://cacheoutattack.com/CacheOut.pdf
https://software.intel.com/security-software-guidance/software-guidance/l1d-eviction-sampling
https://blogs.intel.com/technology/2020/01/ipas-intel-sa-00329/
https://access.redhat.com/solutions/l1d-cache-eviction-and-vector-register-sampling
https://security.archlinux.org/CVE-2020-0543
https://security.archlinux.org/CVE-2020-0548
https://security.archlinux.org/CVE-2020-0549

OSVersionArchitecturePackageVersionFilename
ArchLinuxanyanyintel-ucode< 20200609-1UNKNOWN

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

2.1 Low

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

19.4%