Analysis and mitigation of L1 Terminal Fault (L1TF)

In January 2018, Microsoft released an advisory and security updates for a new class of hardware vulnerabilities involving speculative execution side channels known as Spectre and Meltdown. In this blog post, we will provide a technical analysis of a new speculative execution side channel...

Analysis and mitigation of L1 Terminal Fault (L1TF)

In January 2018, Microsoft released an advisory and security updates for a new class of hardware vulnerabilities involving speculative execution side channels known as Spectre and Meltdown. In this blog post, we will provide a technical analysis of a new speculative execution side channel...

SUSE SLED12 / SLES12 Security Update : libvirt (SUSE-SU-2018:2304-1) (Spectre)

This update for libvirt fixes the following issues: Security issue fixed : - CVE-2018-3639: Add support for 'ssbd' and 'virt-ssbd' CPUID feature bits to address V4 Speculative Store Bypass aka 'Memory Disambiguation' bsc1092885. Bug fixes : - bsc1094325: Enable virsh blockresize for XEN guests...

openSUSE Security Update : libvirt (openSUSE-2018-860) (Spectre)

This update for libvirt fixes the following issues : Security issue fixed : - CVE-2018-3639: Add support for 'ssbd' and 'virt-ssbd' CPUID feature bits to address V4 Speculative Store Bypass aka 'Memory Disambiguation' bsc1092885. Bug fixes : - bsc1094325: Enable virsh blockresize for XEN guests...

NVIDIA Graphics Driver Multiple Vulnerabilities (including fixes for Intel Speculative Side Channel Vulnerabilities) - Lenovo Support US

No description provided...

NVIDIA Graphics Driver Multiple Vulnerabilities (including fixes for Intel Speculative Side Channel Vulnerabilities) - US

Lenovo Security Advisory: LEN-16730 Potential Impact: Denial of service, possible escalation of privilege, exfiltration of privileged memory Severity: High Scope of Impact: Industry-wide CVE Identifier: CVE-2017-5753, CVE-2017-6266, CVE-2017-6267, CVE-2017-6268, CVE-2017-6269, CVE-2017-6270,...

[ASA-201808-8] thunderbird: multiple issues

Arch Linux Security Advisory ASA-201808-8 ========================================= Severity: Critical Date : 2018-08-10 CVE-ID : CVE-2018-5156 CVE-2018-5187 CVE-2018-12361 CVE-2018-12367 CVE-2018-12371 Package : thunderbird Type : multiple issues Remote : Yes Link :...

Security Bulletin: IBM Cloud Manager is affected by the vulnerabilities known as Spectre and Meltdown

Summary IBM Cloud Manager is affected by security vulnerabilities known as Spectre and Meltdown, which can enable CPU data cache timing to be abused to bypass conventional memory security restrictions to gain access to privileged memory that should be inaccessible. Vulnerability Details CVEID:...

openSUSE Security Update : kernel-firmware (openSUSE-2018-825) (Spectre)

This update for kernel-firmware to version 20180525 fixes the following issues : This security issue was fixed : - CVE-2017-5715: Prevent unauthorized disclosure of information to an attacker with local user access caused by speculative execution and indirect branch prediction bsc1095735 This...

RHEL 6 : kernel (RHSA-2018:2309) (Spectre)

An update for kernel is now available for Red Hat Enterprise Linux 6.6 Advanced Update Support and Red Hat Enterprise Linux 6.6 Telco Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base...

SUSE SLES12 Security Update : libvirt (SUSE-SU-2018:2141-1) (Spectre)

This update for libvirt fixes the following issues: Security issues fixed : - CVE-2018-3639: Add support for 'ssbd' and 'virt-ssbd' CPUID feature bits to address V4 Speculative Store Bypass aka 'Memory Disambiguation' bsc1092885. - CVE-2018-1064: Fix denial of service problem during reading from...

RHEL 7 : Virtualization Manager (RHSA-2018:2328) (Spectre)

An update for rhvm-setup-plugins is now available for Red Hat Virtualization Engine 4.2. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

SUSE SLES12 Security Update : libvirt (SUSE-SU-2018:2082-1) (Spectre)

This update for libvirt fixes the following issues: Security issues fixed : - CVE-2017-5715: Fixes for speculative side channel attacks aka 'SpectreAttack' var2 bsc1079869. - CVE-2018-3639: Add support for 'ssbd' and 'virt-ssbd' CPUID feature bits to address V4 Speculative Store Bypass aka 'Memor...

Slackware 14.2 : Slackware 14.2 kernel (SSA:2018-208-01) (Spectre)

New kernel packages are available for Slackware 14.2 to fix security issues. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2018-208-01. The text itself is copyright C Slackware Linux, Inc. include'compat.inc...

Spectre attack variant can be remotely mounted to extract sensitive data

By ghostadmin What we know so far about Spectre attacks is that it relies upon execution of malicious code. The code is executed on computers having speculative-execution design flaws in processor chip; once a device is compromised, it becomes possible to obtain sensitive data such as passwords,...

Security Bulletin: IBM Security Identity Governance and Intelligence has released a fixpack in response to the vulnerabilities known as Spectre and Meltdown

Summary IBM has released the following fixpack for IBM Security Identity Governance and Intelligence in response to CVE-2017-5753 and CVE-2017-5754 Vulnerability Details CVEID: CVE-2017-5753 DESCRIPTION: Intel Haswell Xeon, AMD PRO and ARM Cortex A57 CPUs could allow a local authenticated attacke...

NetSpectre — New Remote Spectre Attack Steals Data Over the Network

A team of security researchers has discovered a new Spectre attack that can be launched over the network, unlike all other Spectre variants that require some form of local code execution on the target system. Dubbed "NetSpectre ," the new remote side-channel attack, which is related to Spectre...

NetSpectre — New Remote Spectre Attack Steals Data Over the Network

A team of security researchers has discovered a new Spectre attack that can be launched over the network, unlike all other Spectre variants that require some form of local code execution on the target system. Dubbed "NetSpectre," the new remote side-channel attack, which is related to Spectre...

SUSE SLES11 Security Update : microcode_ctl (SUSE-SU-2018:2076-1) (Spectre)

This update for microcodectl fixes the following issues: The Intel CPU Microcode bundle was updated to the 20180703 release For the listed CPU chipsets this fixes CVE-2018-3640 Spectre v3a and helps mitigating CVE-2018-3639 Spectre v4 bsc1100147 bsc1087082 bsc1087083 More details can be found on:...

Debian DLA-1446-1 : intel-microcode security update (Spectre)

Security researchers identified two software analysis methods that, if used for malicious purposes, have the potential to improperly gather sensitive data from multiple types of computing devices with different vendors processors and operating systems. This update requires an update to the...