Partial Physical Address Leakage Vulnerability - Lenovo Support US

Lenovo Security Advisory: LEN-27842

Potential Impact: Information disclosure

Severity: Low

Scope of Impact: Industry-wide

CVE Identifier: CVE-2019-0174

Summary Description:

A potential security vulnerability in some microprocessors may allow partial information disclosure via local access. This vulnerability is referred to by the researchers as RAMBleed. RAMBleed is a new Rowhammer style attack to leak information from certain DRAM modules. Systems using DRAM modules mitigated against Rowhammer style attacks remain protected from RAMBleed.

Mitigation Strategy for Customers (what you should do to protect yourself):

Partial physical address information potentially disclosed through exploitation of this vulnerability does not contain user secrets, but could potentially be utilized to enhance unrelated attack methods. For published exploits that Intel is aware of, Intel recommends users follow existing best practices including:

• The use of DRAM modules resistant to Rowhammer style attacks.
• Security Best Practices For Side Channel Resistance: <https://software.intel.com/security-software-guidance/insights/security-best-practices-side-channel-resistance&gt;
• Guidelines For Mitigating Timing Side Channels Against Cryptographic Implementations: <https://software.intel.com/security-software-guidance/insights/guidelines-mitigating-timing-side-channels-against-cryptographic-implementations&gt;

References:

Intel Security Advisory: <https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00247.html&gt;

Security Best Practices For Side Channel Resistance: <https://software.intel.com/security-software-guidance/insights/security-best-practices-side-channel-resistance&gt;

Guidelines For Mitigating Timing Side Channels Against Cryptographic Implementations: <https://software.intel.com/security-software-guidance/insights/guidelines-mitigating-timing-side-channels-against-cryptographic-implementations&gt;

Revision History:

For a complete list of all Lenovo Product Security Advisories, click here.

For the most up to date information, please remain current with updates and advisories from Lenovo regarding your equipment and software. The information provided in this advisory is provided on an “as is” basis without any warranty or guarantee of any kind. Lenovo reserves the right to change or update this advisory at any time.