Security Bulletin: Vulnerability in side channel in Intel CPUs affect IBM Cloud Pak System (CVE-2019-11135)

Summary

IBM Cloud Pak System when using Intel CPUs could allow a local authenticated attacker to obtain sensitive information. OS image for RedHat Enterprise Linux for Cloud Pak System is shipped as component for IBM Cloud Pak System. OS image for RedHat Enterprise Linux addressed vulnerability.

Vulnerability Details

CVEID:CVE-2019-11135
**DESCRIPTION:**Multiple Intel CPUs could allow a local authenticated attacker to obtain sensitive information, caused by a TSX Asynchronous Abort condition. By using side channel attacks, an attacker could exploit this vulnerability to obtain sensitive information.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/175029 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

For IBM Cloud Pak System v2.3.0.1, v2.3.1.1

- SW base OS Image for Red Hat Linux include kernel updates. Cloud Pak System v2.3.3.3 provide fixed level with VMware EsXi6.7.

Upgrade to IBM Cloud Pak System v.2.3.3.0 or later.

- HW firmware

Upgrade to IBM Cloud Pak System v.2.3.3.2. in 4Q2020.

Information on upgrading can be found here: <http://www.ibm.com/support/docview.wss?uid=ibm10887959&gt;

Workarounds and Mitigations

None