5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
2.1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
0.001 Low
EPSS
Percentile
18.0%
Severity: High
Date : 2020-06-13
CVE-ID : CVE-2020-0543 CVE-2020-0548 CVE-2020-0549
Package : intel-ucode
Type : information disclosure
Remote : No
Link : https://security.archlinux.org/AVG-1187
The package intel-ucode before version 20200609-1 is vulnerable to
information disclosure.
Upgrade to 20200609-1.
The problems have been fixed upstream in version 20200609.
None.
A new domain bypass transient execution attack known as Special
Register Buffer Data Sampling (SRBDS) has been found. This flaw allows
data values from special internal registers to be leaked by an attacker
able to execute code on any core of the CPU. An unprivileged, local
attacker can use this flaw to infer values returned by affected
instructions known to be commonly used during cryptographic operations
that rely on uniqueness, secrecy, or both.
A flaw was found in Intel processors where a local attacker is able to
gain information about registers used for vector calculations by
observing register states from other processes running on the system.
This results in a race condition where store buffers, which were not
cleared, could be read by another process or a CPU sibling. The highest
threat from this vulnerability is data confidentiality where an
attacker could read arbitrary data as it passes through the processor.
A microarchitectural timing flaw was found on some Intel processors. A
corner case exists where data in-flight during the eviction process can
end up in the “fill buffers” and not properly cleared by the MDS
mitigations. The fill buffer contents (which were expected to be blank)
can be inferred using MDS or TAA style attack methods to allow a local
attacker to infer fill buffer values.
A local unprivileged attacker with access to an affected CPU can read
protected memory through a shared buffer on an SGX enclave or CPU core.
https://software.intel.com/security-software-guidance/insights/deep-dive-special-register-buffer-data-sampling
https://blogs.intel.com/technology/2020/06/ipas-security-advisories-for-june-2020/#gs.6uyhri
https://cacheoutattack.com/CacheOut.pdf
https://software.intel.com/security-software-guidance/software-guidance/l1d-eviction-sampling
https://blogs.intel.com/technology/2020/01/ipas-intel-sa-00329/
https://access.redhat.com/solutions/l1d-cache-eviction-and-vector-register-sampling
https://security.archlinux.org/CVE-2020-0543
https://security.archlinux.org/CVE-2020-0548
https://security.archlinux.org/CVE-2020-0549
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ArchLinux | any | any | intel-ucode | < 20200609-1 | UNKNOWN |
access.redhat.com/solutions/l1d-cache-eviction-and-vector-register-sampling
blogs.intel.com/technology/2020/01/ipas-intel-sa-00329/
blogs.intel.com/technology/2020/06/ipas-security-advisories-for-june-2020/#gs.6uyhri
cacheoutattack.com/CacheOut.pdf
security.archlinux.org/AVG-1187
security.archlinux.org/CVE-2020-0543
security.archlinux.org/CVE-2020-0548
security.archlinux.org/CVE-2020-0549
software.intel.com/security-software-guidance/insights/deep-dive-special-register-buffer-data-sampling
software.intel.com/security-software-guidance/software-guidance/l1d-eviction-sampling
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
2.1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
0.001 Low
EPSS
Percentile
18.0%