Security Bulletin: IBM Security QRadar Packet Capture is vulnerable to Intel Microarchitectural Data Sampling (MDS) Vulnerabilites (CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091)

Summary

A potential security vulnerability in CPUs may allow information disclosure.

Vulnerability Details

CVEID: CVE-2018-12126 **Description: **Microarchitectural Store Buffer Data Sampling (MSBDS): Store buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. **CVSS Base Score:**6.5 Medium **CVSS Temporal Score:**See <https://exchange.xforce.ibmcloud.com/vulnerabilities/160990&gt; for the current score CVSS Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N .

CVEID: CVE-2018-12127 **Description: **Microarchitectural Load Port Data Sampling (MLPDS): Load ports on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. **CVSS Base Score:**6.5 Medium **CVSS Temporal Score:**See <https://exchange.xforce.ibmcloud.com/vulnerabilities/160990&gt; for the current score CVSS Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CVEID: CVE-2018-12130 **Description: **Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. **CVSS Base Score:**6.5 Medium CVSS Temporal Score:<https://exchange.xforce.ibmcloud.com/vulnerabilities/160992&gt; for the current score CVSS Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

**CVEID:**CVE-2019-11091
**Description:**Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access.
CVSS Base Score: 3.8 Low **CVSS Temporal Score:**See <https://exchange.xforce.ibmcloud.com/vulnerabilities/160993&gt; for the current score CVSS Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Affected Products and Versions

IBM Security QRadar Packet Capture 7.2.0 - 7.2.8 Patch 5

IBM Security QRadar Packet Capture 7.3.0 - 7.3.1 Patch 1

Remediation/Fixes

IBM Security QRadar Packet Capture 7.2.8 Patch 6

IBM Security QRadar Packet Capture 7.3.2 GA