USN-6286-1: Intel Microcode vulnerabilities

Daniel Moghimi discovered that some IntelR Processors did not properly clear microarchitectural state after speculative execution of various instructions. A local unprivileged user could use this to obtain to sensitive information. CVE-2022-40982 It was discovered that some IntelR XeonR Processor...

Debian DSA-5475-1 : linux - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5475 advisory. CVE-2022-40982 Daniel Moghimi discovered Gather Data Sampling GDS, a hardware vulnerability for Intel CPUs which allows unprivileged speculative access to da...

Amazon Linux 2023 : iwl100-firmware, iwl105-firmware, iwl135-firmware (ALAS2023-2023-284)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-284 advisory. An issue in Zen 2 CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information. CVE-2023-20593 Tenable has extracted the preceding description...

Amazon Linux 2 : linux-firmware (ALAS-2023-2190)

The version of linux-firmware installed on the remote host is prior to 20200421-81.git78c0348. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2190 advisory. An issue in Zen 2 CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-285)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-285 advisory. 2023-08-31: CVE-2023-3611 was removed from this advisory. 2023-08-31: CVE-2023-3776 was removed from this advisory. 2023-08-31: The severity of this advisory was changed from important to mediu...

SUSE SLED15: kernel-firmware / kernel-firmware-all / kernel-firmware-amdgpu / etc (SUSE-SU-2023:3298-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3298-1 advisory. - CVE-2023-20569: Fixed AMD 19h ucode to mitigate a side channel vulnerability in some of the AMD CPUs...

Fedora 38 : linux-firmware (2023-755b8bb6db)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-755b8bb6db advisory. New firmware for AMD Zen CPUs to mitigate the AMD 'Inception' attack. Only needed for affected AMD users. Tenable has extracted the preceding description blo...

Input validation

Improper initialization in the BIOS firmware for some IntelR Processors may allow a privileged user to potentially enable information disclosure via local access...

SUSE SLES12 Security Update : kernel-firmware (SUSE-SU-2023:3262-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2023:3262-1 advisory. - CVE-2023-20569: Fixed AMD 19h ucode to mitigate a side channel vulnerability in some of the AMD CPUs. bsc1213287 Tenable has extracted the preceding...

Missing Linux Kernel mitigations for 'Speculative Return Stack Overflow (SRSO)' hardware vulnerability (INCEPTION, AMD-SB-7005)

The remote host is missing one or more known mitigations on Linux Kernel side for the referenced SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-onl...

SUSE: Security Advisory (SUSE-SU-2023:3262-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 37 : kernel (2023-638681260a)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-638681260a advisory. The 6.4.9 stable kernel update contains a number of important fixes across the tree. Tenable has extracted the preceding description block directly...

Fedora 38 : kernel (2023-ddfd3073b3)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-ddfd3073b3 advisory. The 6.4.9 stable kernel update contains a number of important fixes across the tree. Tenable has extracted the preceding description block directly...

Collide+Power, Downfall, and Inception: New Side-Channel Attacks Affecting Modern CPUs

Cybersecurity researchers have disclosed details of a trio of side-channel attacks that could be exploited to leak sensitive data from modern CPUs. Called Collide+Power CVE-2023-20583, Downfall CVE-2022-40982, and Inception CVE-2023-20569, the novel methods follow the disclosure of another newly...

Novel ‘Inception’ Attack Exposes Sensitive Data in CPUs

By Habiba Rashid Dreams of Science Fiction Realized: ETH Researchers Demonstrate "Inception" Attack on CPUs. This is a post from HackRead.com Read the original post: Novel Inception Attack Exposes Sensitive Data in CPUs...

CVE-2023-20569

A side channel vulnerability was found in hw amd. Some AMD CPUs may allow an attacker to influence the return address prediction. This issue may result in speculative execution at an attacker-controlled instruction pointer register, potentially leading to information disclosure. Mitigation...

CVE-2023-20569

A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in speculative execution at an attacker-controlled address, potentially leading to information disclosure...

CVE-2023-20569

A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in speculative execution at an attacker-controlled address, potentially leading to information disclosure...

Information disclosure

A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in speculative execution at an attacker-controlled?address, potentially leading to information disclosure...

Citrix Hypervisor Security Bulletin for CVE-2023-20569, CVE-2023-34319 and CVE-2022-40982

Description of Problem An issue has been discovered in Citrix Hypervisor 8.2 CU1 LTSR that may allow malicious, privileged code in a guest VM to cause the host to crash. This issue has the following identifier: CVE-2023-34319 In addition, Intel has disclosed a security issue affecting certain Int...