Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2022-9273)

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9273 advisory. - KVM: x86/mmu: do compare-and-exchange of gPTE via the user address Paolo Bonzini Orabug: 34053807 CVE-2022-1158 - netfilter: nftables: initialize...

Intel CPU vulnerability CVE-2021-0091

Improper access control in the firmware for some IntelR Processors may allow an unauthenticated user to potentially enable an escalation of privilege via local access. CVE-2021-0091 Impact An attacker may be able to exploit the Intel processor firmware to gain elevated access to resources. The...

Intel CPU vulnerability CVE-2021-0092

Improper access control in the firmware for some IntelR Processors may allow a privileged user to potentially enable a denial of service via local access. CVE-2021-0092 Impact An attacker may be able to exploit the Intel processor firmware to gain elevated access to resources. The following...

Intel CPU vulnerability CVE-2021-0119

Improper initialization in the firmware for some IntelR Processors may allow a privileged user to potentially enable escalation of privilege via physical access. CVE-2021-0119 Impact An attacker may be able to exploit the Intel processor firmware to gain elevated access to resources. The followin...

ARM Neoverse和Cortex 安全漏洞

The cortex is an application software. Provides horizontally scalable, high-availability, multi-tenant long-term storage.ARM Neoverse is a high-performance ARM microarchitecture from ARM UK. It is used to maximize single-core performance for systems running demanding compute- and memory-intensive...

Mageia: Security Advisory (MGASA-2019-0173)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mitsubishi Electric MELSEC iQ-R series 信息泄露漏洞

The Mitsubishi Electric MELSEC iQ-R series is a programmable logic controller from Mitsubishi Electric, Japan.Expo is an open-source platform for creating React Native applications from Expo, which provides a number of tools and services that make developing React Native applications easier. An...

Speculative Code Store Bypass

ISSUE DESCRIPTION Modern superscalar processors may employ sophisticated decoding and caching of the instruction stream to improve performance. However, a consequence is that self-modifying code updates may not take effect instantly. Whatever the architectural guarantees, some CPUs have...

Microarchitectural Data Sampling Advisory

Summary: A potential security vulnerability in CPUs may allow information disclosure. Intel is releasing Microcode Updates MCU updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2018-12126 Microarchitectural Store Buffer Data Sampling MSBDS: Store buffers on some...

Xen Paging Tables Race Condition (XSA-328)

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by an issue allowing Intel guest OS users to gain privileges or cause a denial of service because of non-atomic modification of a live EPT PTE. When mapping guest EPT nested paging tables, X...

SUSE: Security Advisory (SUSE-SU-2018:1614-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-15567

An issue was discovered in Xen through 4.13.x, allowing Intel guest OS users to gain privileges or cause a denial of service because of non-atomic modification of a live EPT PTE. When mapping guest EPT nested paging tables, Xen would in some circumstances use a series of non-atomic bitfield write...

CVE-2020-15567

An issue was discovered in Xen through 4.13.x, allowing Intel guest OS users to gain privileges or cause a denial of service because of non-atomic modification of a live EPT PTE. When mapping guest EPT nested paging tables, Xen would in some circumstances use a series of non-atomic bitfield write...

Unbreakable Enterprise kernel security update

4.1.12-124.39.5.1 - x86/speculation: Add Ivy Bridge to affected list Josh Poimboeuf Orabug: 31352782 CVE-2020-0543 - x86/speculation: Add SRBDS vulnerability and mitigation documentation Mark Gross Orabug: 31352782 CVE-2020-054 3 - x86/speculation: Add Special Register Buffer Data Sampling SRBDS...

Information disclosure

An information disclosure vulnerability exists when certain central processing units CPU speculatively access memory, aka 'Windows Kernel Information Disclosure in CPU Memory Access'...

LVI Attacks: New Intel CPU Vulnerability Puts Data Centers At Risk

It appears there is no end in sight to the hardware level security vulnerabilities in Intel processors, as well as to the endless 'performance killing' patches that resolve them. Modern Intel CPUs have now been found vulnerable to a new attack that involves reversely exploiting Meltdown-type data...

SUSE-SU-2020:0558-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2020-2732: Fixed an issue affecting Intel CPUs where an L2 guest may trick the L0 hypervisor into accessing sensitive L1 resources bsc1163971. -...

New ‘CacheOut’ Attack Targets Intel CPUs

Researchers have identified a new speculative execution type attack, dubbed CacheOut, that could allow attackers to trigger data leaks from most Intel CPUs. The more serious of the two bugs, revealed Monday, is rated medium severity by Intel, who said fixes for both flaws are on the way. The more...

[SECURITY] [DLA 2051-1] intel-microcode security update

Package : intel-microcode Version : 3.20191115.2deb8u1 CVE ID : CVE-2019-11135 CVE-2019-11139 This update ships updated CPU microcode for some types of Intel CPUs. In particular it provides mitigations for the TAA TSX Asynchronous Abort vulnerability. For affected CPUs, to fully mitigate the...

A week in security (December 9 – 15)

Last week on Malwarebytes Labs, we cautioned readers against purchasing potentially privacy-invasive, cyber-insecure smart doorbells, warned about a new credit card skimmer vulnerability embedded within hundreds of fraudulent web sites selling supposedly name-brand shoes, and looked at the newest...