2507 matches found
PT-2019-2190 · Intel +8 · Intel Microprocessors +12
Name of the Vulnerable Software and Affected Versions: Intel Microprocessors affected versions not specified vCenter Server affected versions not specified ESXi affected versions not specified Workstation affected versions not specified Fusion affected versions not specified Description: The issu...
RSA Conference 2019: Picking Apart the Foreshadow Attack
SAN FRANCISCO – Starting off with a bang with Spectre and Meltdown, 2018 was the year of speculative execution vulnerabilities in CPUs, which wreaked havoc in the IT industry. One of these attacks, dubbed Foreshadow, could allow unauthorized disclosure of information. Foreshadow impacts the Intel...
Spectre, Google, and the Universal Read Gadget
Spectre, a seemingly never ending menace to processors, is back in the limelight once again thanks to the Universal Read Gadget. First seen at the start of 2018, Spectre emerged alongside Meltdown as a major potential threat to people’s system security. Meltdown and Spectre Meltdown targeted Inte...
Intel ARM Processor Speculative Execution Information Disclosure
The vulnerabilities of Intel and ARM processors are related to the use of speculative execution and memory reading before returning addresses of previous write operations to memory. Exploiting these vulnerabilities can allow attackers to disclose sensitive information through specially crafted...
Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4531)
The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4531 advisory. - x86/bugs: Fix the AMD SSBD usage of the SPECCTRL MSR Tom Lendacky Orabug: 28870524 CVE-2018-3639 - x86/bugs: Add AMD's SPECCTRL MSR usage Konrad...
DEBIAN-CVE-2019-7308
kernel/bpf/verifier.c in the Linux kernel before 4.20.6 performs undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks...
Security Bulletin: IBM Security QRadar Packet Capture is vulnerable to 3RD PARTY CPU hardware utilizing speculative execution cache timing side-channel analysis known as Variant 4 or SpectreNG (CVE-2018-3639, CVE-2018-3640)
Summary Speculative execution is a technique used by many modern processors to improve performance by predicting which instructions may be executed based on past execution history. An attacker with local user access may be able to utilize sequences of speculative execution to perform a cache timi...
Security Bulletin: IBM QRadar Network Packet Capture is vulnerable to 3RD PARTY CPU hardware utilizing speculative execution cache timing side-channel analysis known as Variant 4 or SpectreNG (CVE-2018-3639, CVE-2018-3640)
Summary Speculative execution is a technique used by many modern processors to improve performance by predicting which instructions may be executed based on past execution history. An attacker with local user access may be able to utilize sequences of speculative execution to perform a cache timi...
SUSE-SU-2019:0148-1 Security update for the Linux Kernel
The SUSE Linux Enterprise 12 SP3 kernel for Azure was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2018-19407: The vcpuscanioapic function in arch/x86/kvm/x86.c allowed local users to cause a denial of service NULL pointer dereference and BUG via...
hw: cpu: speculative store bypass
An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions a commonly used performance optimization. It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the...
Microsoft Launches Azure DevOps Bug Bounty Program
Microsoft lifted the curtain on a new Azure DevOps bug bounty program, designed to sniff out flaws in its Azure DevOps online services and servers. Azure DevOps is a cloud service launched in 2018 that enables collaboration on code development across the breadth of a development lifecycle...
Information Disclosure
Systems with microprocessors utilizing speculative execution and address translations are vulnerable to information disclosure. An L1TF issue allows an unprivileged attacker to read privileged memory of the kernel or other processes by conducting targeted cache side-channel attacks...
Information Disclosure
Linux kernel is vulnerable to information disclosure. The FPU state information is disclosed in a lazy FPU restore, which would allow a local process to determine information from another process through a specilative execution side channel...
Information Disclosure
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known, are vulnerable to information disclosure. A local unprivileged attacker is able to perform a side-channel analysis known as Speculative...
January 8, 2019—KB4480970 (Monthly Rollup)
None None...
SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2018:2409-1) (Foreshadow)
This update for xen fixes the following security issues : - CVE-2018-3646: Systems with microprocessors utilizing speculative execution and address translations may have allowed unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest O...
SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2018:2092-1) (Spectre)
The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes. The following new feature was added : - NVDIMM memory error notification ACPI 6.2 The following security bugs were fixed : - CVE-2018-13406: An integer overflow in the uvesafbsetcmap function could have resu...
Lazy FP State Restore - Lenovo Support US
No description provided...
Lazy FP State Restore - US
Lenovo Security Advisory: LEN-22880 Potential Impact: Information Disclosure Severity: Medium Scope of Impact: Industry-wide CVE Identifier: CVE-2018-3665 Summary Description: Intel states that system software may utilize the Lazy FP state restore technique to delay the restoring of state until a...