Processor Vulnerabilities – Meltdown and Spectre

UPDATE 1/4/2018: Qualys has released several QIDs for detecting missing patches for these vulnerabilities. UPDATE 1/5/2018: Pre-built AssetView dashboards to visualize impact and remediation progress. Vulnerabilities potentially impacting all major processor vendors were disclosed today by Google...

microcode_ctl security update

2.1-22.2 - Update Intel CPU microde for 06-3f-02, 06-4f-01, and 06-55-04 - Resolves: 1527358 2.1-22.1 - Update to upstream 2.1-13. Intel CPU microcode update to 20170707. - Resolves: 1474844...

Scientific Linux Security Update : microcode_ctl on SL6.x i386/x86_64 (20180103) (Spectre)

Security Fixes : - An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions a commonly used performance optimization. There are three primary variants of the issue which differ in the way the speculative execution can be...

libvirt security update

0.10.2-62.0.1.el69.1 - Replace docs/et.png in tarball with blank image 0.10.2-62.el69.1 - util: Implement virFileReadHeaderFD CVE-2017-5715 - util: add virFileReadHeaderQuiet wrapper around virFileReadHeaderFD CVE-2017-5715 - util: introduce virHostCPUGetMicrocodeVersion CVE-2017-5715 - conf:...

SUSE SLES11 Security Update : kernel (SUSE-SU-2018:0011-1) (Meltdown) (Spectre)

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes. This update adds mitigations for various side channel attacks against modern CPUs that could disclose content of otherwise unreadable memory bnc1068032. - CVE-2017-5753: Local attackers on systems with...

kernel security update

3.10.0-693.11.6.OL7 - Oracle Linux certificates Alexey Petrenko - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey bug 24817676 3.10.0-693.11.6 - x86 specctrl: Eliminate redundant FEATURE Not Present messages Andrea...

HPSBHF03573 rev. 15 - Side-Channel Analysis Method

Potential Security Impact Elevation of Privilege/Information Disclosure Source: HP, HP Product Security Response Team PSRT Reported by: Google Project Zero VULNERABILITY SUMMARY An industry-wide vulnerability, known as side channel analysis method, has been disclosed with modern CPUs using...

microcode_ctl security update

1:1.17-25.2 - Update Intel CPU microde for 06-3f-02, 06-4f-01, and 06-55-04 - Add amd microcodeamdfam17h.bin data file - Resolves: 1527357 1:1.17-25.1 - Update microcode data file to 20170707 revision. - Resolves: 1465143...

(RHSA-2018:0013) Important: microcode_ctl security update

The microcodectl packages provide microcode updates for Intel and AMD processors. Security Fixes: An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions a commonly used performance optimization. There are three primary...

SUSE-SU-2017:2696-1 Security update for dracut

This update for dracut fixes the following issues: Security issues fixed: - CVE-2016-8637: When the early microcode loading was enabled during initrd creation, the initrd would be read-only available for all users, allowing local users to retrieve secrets stored in the initial ramdisk. bsc1008340...

Microsoft MsMpEng - Multiple Problems Handling ntdll!NtControlChannel Commands Exploit

Exploit for windows platform in category local exploits Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1260 MsMpEng includes a full system x86 emulator that is used to execute any untrusted files that look like PE executables. The emulator runs as NT AUTHORITY\SYSTEM and isn't...

Microsoft MsMpEng - Multiple Problems Handling ntdll!NtControlChannel Commands

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1260 MsMpEng includes a full system x86 emulator that is used to execute any untrusted files that look like PE executables. The emulator runs as NT AUTHORITY\SYSTEM and isn't sandboxed. Browsing the list of win32 APIs that the...

Microsoft MsMpEng - Multiple Problems Handling ntdll!NtControlChannel Commands

Microsoft MsMpEng - Multiple Problems Handling ntdll!NtControlChannel Commands Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1260 MsMpEng includes a full system x86 emulator that is used to execute any untrusted files that look like PE executables. The emulator runs as NT...

openSUSE Security Update : dracut (openSUSE-2017-482)

This update for dracut fixes the following issues : Security issues fixed : - CVE-2016-8637: When the early microcode loading was enabled during initrd creation, the initrd would be read-only available for all users, allowing local users to retrieve secrets stored in the initial ramdisk. bsc10083...

CVE-2017-7262

The AMD Ryzen processor with AGESA microcode through 2017-01-27 allows local users to cause a denial of service system hang via an application that makes a long series of FMA3 instructions, as demonstrated by the Flops test suite...

CVE-2017-7262

The AMD Ryzen processor with AGESA microcode through 2017-01-27 allows local users to cause a denial of service system hang via an application that makes a long series of FMA3 instructions, as demonstrated by the Flops test suite...

Design/Logic Flaw

The AMD Ryzen processor with AGESA microcode through 2017-01-27 allows local users to cause a denial of service system hang via an application that makes a long series of FMA3 instructions, as demonstrated by the Flops test suite...

CVE-2017-7262

The vulnerability affects AMD Ryzen processors with AGESA microcode up to 2017-01-27. The issue arises when an application executes a long sequence of FMA3 instructions, leading to a local denial of service (system hang) as demonstrated by the Flops test suite. No public exploit details are provi...

CVE-2017-7262

The AMD Ryzen processor with AGESA microcode through 2017-01-27 allows local users to cause a denial of service system hang via an application that makes a long series of FMA3 instructions, as demonstrated by the Flops test suite...

openSUSE Security Update : dracut (openSUSE-2017-347)

This update for dracut fixes the following issues : Security issues fixed : - CVE-2016-8637: When the early microcode loading was enabled during initrd creation, the initrd would be read-only available for all users, allowing local users to retrieve secrets stored in the initial ramdisk. bsc10083...