hw: cpu: speculative execution permission faults handling

An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions a commonly used performance optimization. There are three primary variants of the issue which differ in the way the speculative execution can be exploited. Variant...

May 8, 2018—KB4103723 (OS Build 14393.2248) - EXPIRED

None None...

8 New Spectre-Class Vulnerabilities (Spectre-NG) Found in Intel CPUs

A team of security researchers has reportedly discovered a total of eight new "Spectre-class" vulnerabilities in Intel CPUs, which also affect at least a small number of ARM processors and may impact AMD processor architecture as well. Dubbed Spectre-Next Generation, or Spectre-NG, the partial...

8 New Spectre-Class Vulnerabilities (Spectre-NG) Found in Intel CPUs

A team of security researchers has reportedly discovered a total of eight new "Spectre-class" vulnerabilities in Intel CPUs, which also affect at least a small number of ARM processors and may impact AMD processor architecture as well. Dubbed Spectre-Next Generation , or Spectre-NG , the partial...

CVE-2018-6242

CVE-2018-6242 affects NVIDIA Tegra mobile processors released before 2016, via a buffer overflow in BootROM Recovery Mode (RCM). The underlying issue lets an attacker with physical access and a USB connection force reboot into RCM to execute unverified code. Public materials confirm exploit guida...

Two NSA Algorithms Rejected by the ISO

The ISO has rejected two symmetric encryption algorithms: SIMON and SPECK. These algorithms were both designed by the NSA and made public in 2013. They are optimized for small and low-cost processors like IoT devices. The risk of using NSA-designed ciphers, of course, is that they include...

Google Android has an unspecified vulnerability (CNVD-2018-10036)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA, and the Qualcomm SD 400 and Qualcomm SD 800 are central processing unit CPU products from Qualcomm. A security vulnerability exists in the Qualcomm closed-source component of Goog...

RHEL 6 : kernel-rt (RHSA-2018:1170)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1170 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...

MalPipe - Malware/IOC Ingestion And Processing Engine

MalPipe is a modular malware and indicator collection and processing framework. It is designed to pull malware, domains, URLs and IP addresses from multiple feeds, enrich the collected data and export the results. At this time, the following feeds are supported: VirusTotal...

Facebook Plans to Build Its Own Chips For Hardware Devices

A new job opening post on Facebook suggests that the social network is forming a team to build its own hardware chips, joining other tech titans like Google, Apple, and Amazon in becoming more self-reliant. According to the post, Facebook is looking for an expert in ASIC and FPGA—two custom silic...

Google Android has an unspecified vulnerability (CNVD-2018-09779)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA, and the Qualcomm SD 845 and SD 850 are central processing unit CPU products from Qualcomm. A security vulnerability exists in the Qualcomm closed-source component of Google Androi...

Integer overflow

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, and SD 820A, in an EMM command, an integer underflow can occ...

CVE-2015-9173

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 410/12, SD 617, SD 650/52, SD 800, SD 808, and SD 810, missing of return value check in memscpy can cause memory corruption in TQS App...

CVE-2015-9193

CVE-2015-9193 affects Android devices with Qualcomm Snapdragon platforms (Automobile, Mobile, Wear) across multiple SDM/SDC/SDM series. The issue is improper input validation that can cause memory overread, leading to application crashes. Public details indicate impact up to Android patch level 2...

Intel Processors Now Allows Antivirus to Use Built-in GPUs for Malware Scanning

Global chip-maker Intel on Tuesday announced two new technologies—Threat Detection Technology TDT and Security Essentials—that not only offer hardware-based built-in security features across Intel processors but also improve threat detection without compromising system performance. Intel's Threat...

AMD processors affected by vulnerabilities: Ryzenfall, Fallout, Chimera and Masterkey

A collection of AMD vulnerabilities known as "Ryzenfall, Fallout, Chimera, Masterkey" has been released. Attackers in possession of these vulnerabilities would receive additional capabilities, like persistence by malware injection, stealth, network credential theft and more. It affects AMD...

AMD Rolls Out Spectre Fixes

AMD said that CPU firmware and Windows 10 patches are now available to safeguard its products against the Spectre security flaw. Mark Papermaster, senior vice president and chief technology officer at AMD, said in a Tuesday post that Spectre fixes are available for AMD customers, who can download...

Kernel: KVM: DoS via write flood to I/O port 0x80

Linux kernel Virtualization Module CONFIGKVM for the Intel processor family CONFIGKVMINTEL is vulnerable to a DoS issue. It could occur if a guest was to flood the I/O port 0x80 with write requests. A guest user could use this flaw to crash the host kernel resulting in DoS...

Denial of Service Vulnerability in Multiple Intel Products

Intel 5th generation Intel Core Processors are different series of CPU Central Processing Unit products of Intel Corporation. A security vulnerability exists in the SPI Flash configuration in the platform on multiple Intel products. A local attacker could exploit this vulnerability to cause a...

USN-3619-1: Linux kernel vulnerabilities

Jann Horn discovered that the Berkeley Packet Filter BPF implementation in the Linux kernel improperly performed sign extension in some situations. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2017-16995 It was discovered that a...