Potential security vulnerabilities in CPUs may allow information disclosure. Intel released Microcode Updates (MCU) updates to mitigate this potential vulnerability. IBM Integrated Analytics System has addressed the applicable CVE.
CVEID: CVE-2019-11091 DESCRIPTION: Intel Microprocessor could allow a local authenticated attacker to obtain sensitive information, caused by a Microarchitectural Data Sampling Uncacheable Memory (MDSUM) vulnerability that allows uncacheable memory on some microprocessors utilizing speculative execution. An attacker could exploit this vulnerability using a side-channel attack to obtain data that is being processed in the CPU by other apps. Note: This is called the Zombieload attack.
CVSS Base Score: 3.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/160993> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)
CVEID: CVE-2018-12130 DESCRIPTION: Intel Microprocessor could allow a local authenticated attacker to obtain sensitive information, caused by a Microarchitectural Data Sampling (MDS) vulnerability that fills buffers on some microprocessors utilizing speculative execution. An attacker could exploit this vulnerability using a side-channel attack to obtain data that is being processed in the CPU by other apps. Note: This is called the Zombieload attack.
CVSS Base Score: 6.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/160992> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)
CVEID: CVE-2018-12127 DESCRIPTION: Intel Microprocessor could allow a local authenticated attacker to obtain sensitive information, caused by a Microarchitectural Data Sampling (MDS) vulnerability that fills buffers on some microprocessors utilizing speculative execution. An attacker could exploit this vulnerability using a side-channel attack to obtain data that is being processed in the CPU by other apps. Note: This is called the Zombieload attack.
CVSS Base Score: 6.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/160991> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)
CVEID: CVE-2018-12126 DESCRIPTION: Intel Microprocessor could allow a local authenticated attacker to obtain sensitive information, caused by a Microarchitectural Data Sampling (MDS) vulnerability that stores buffers on some microprocessors utilizing speculative execution. An attacker could exploit this vulnerability using a side-channel attack to obtain data that is being processed in the CPU by other apps. Note: This is called the Zombieload attack.
CVSS Base Score: 6.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/160990> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)
Update to the following IBM Integrated Analytics System release :
Product | VRMF | Remediation / First Fix |
---|---|---|
IBM Integrated Analytics System | 1.0.18.0 | Link to Fix Central |