kernel: Indirect branch speculation can be enabled after it was force-disabled by the PR_SPEC_FORCE_DISABLE prctl command.

A flaw was found in the prctl function, where it can be used to enable indirect branch speculation after it has been disabled. This call incorrectly reports it as being 'force disabled' when it is not and opens the system to Spectre v2 attacks. The highest threat from this vulnerability is to...

kernel: Indirect Branch Prediction Barrier is force-disabled when STIBP is unavailable or enhanced IBRS is available.

A flaw was found in the Linux kernel’s implementation of the Enhanced IBPB Indirect Branch Prediction Barrier. The IBPB mitigation will be disabled when STIBP is not available or when the Enhanced Indirect Branch Restricted Speculation IBRS is available. This flaw allows a local attacker to perfo...

kernel: Indirect Branch Prediction Barrier is force-disabled when STIBP is unavailable or enhanced IBRS is available.

A flaw was found in the Linux kernel’s implementation of the Enhanced IBPB Indirect Branch Prediction Barrier. The IBPB mitigation will be disabled when STIBP is not available or when the Enhanced Indirect Branch Restricted Speculation IBRS is available. This flaw allows a local attacker to perfo...

kernel: Indirect branch speculation can be enabled after it was force-disabled by the PR_SPEC_FORCE_DISABLE prctl command.

A flaw was found in the prctl function, where it can be used to enable indirect branch speculation after it has been disabled. This call incorrectly reports it as being 'force disabled' when it is not and opens the system to Spectre v2 attacks. The highest threat from this vulnerability is to...

Important: Red Hat Security Advisory: kernel-rt security and bug fix update

An update for kernel-rt is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

kernel: Indirect Branch Prediction Barrier is force-disabled when STIBP is unavailable or enhanced IBRS is available.

A flaw was found in the Linux kernel’s implementation of the Enhanced IBPB Indirect Branch Prediction Barrier. The IBPB mitigation will be disabled when STIBP is not available or when the Enhanced Indirect Branch Restricted Speculation IBRS is available. This flaw allows a local attacker to perfo...

kernel: Indirect branch speculation can be enabled after it was force-disabled by the PR_SPEC_FORCE_DISABLE prctl command.

A flaw was found in the prctl function, where it can be used to enable indirect branch speculation after it has been disabled. This call incorrectly reports it as being 'force disabled' when it is not and opens the system to Spectre v2 attacks. The highest threat from this vulnerability is to...

RHEL 8 : kernel (RHSA-2020:3041)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3041 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: kernel: DAX hugepages not...

CISA Releases Emergency Directive on Critical Microsoft Vulnerability

The Cybersecurity and Infrastructure Security Agency CISA has released Emergency Directive 20-03 addressing a critical vulnerability—CVE-2020-1350—affecting all versions of Windows Server with the Domain Name System DNS role enabled. A remote attacker could exploit this vulnerability to take...

[SECURITY] Fedora 32 Update: botan2-2.14.0-1.fc32

Botan is a BSD-licensed crypto library written in C++. It provides a wide variety of basic cryptographic algorithms, X.509 certificates and CRLs, PKCS \10 certificate requests, a filter/pipe message processing system, and a wide variety of other features, all written in portable C++. The API...

The vulnerability of the implementation of the Single Thread Indirect Branch Predictors (STIBP) in the Linux operating system allows a hacker to gain unauthorized access to protected information.

The vulnerability of the Linux operating system’s kernel implementation of the Single Thread Indirect Branch Predictors STIBP technology is related to insufficient input data validation and incorrect implementation of functions. Exploiting this vulnerability can allow an attacker to gain...

kernel: use-after-free in arch/x86/lib/insn-eval.c

A vulnerability was found in the arch/x86/lib/insn-eval.c function in the Linux kernel. An attacker could corrupt the memory due to a flaw in use-after-free access to an LDT entry caused by a race condition between modifyldt and a BR exception for an MPX bounds violation...

Unspecified Vulnerability in CloudBees Jenkins Stash Branch Parameter Plugin

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Stash Branch Parameter Plugin is used in one...

CVE-2020-2210

Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure...

CVE-2020-2210

Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure...

Code injection

Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure...

CVE-2020-2210

Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure...

CVE-2020-2210

The CVE-2020-2210 entry concerns Jenkins Stash Branch Parameter Plugin versions 0.3.0 and earlier, where configured passwords are transmitted in plain text as part of the global Jenkins configuration form. Root cause: the plugin stores the Stash API password in the controller’s config file, and a...

SUSE-SU-2020:1713-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2020-10768: Fixed an issue with the prctl function which could have allowed indirect branch speculation even after it has been disabled bsc1172783. -...

SUSE-SU-2020:1693-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2020-10768: The prctl function could be used to enable indirect branch speculation even after it has been disabled. bnc1172783 - CVE-2020-10766: A bug in the...