vulnerability
Oracle Linux: CVE-2018-12126: ELSA-2019-1181: qemu-kvm security update (IMPORTANT) (Multiple Advisories)
Severity | CVSS | Published | Added | Modified |
---|---|---|---|---|
5 | (AV:L/AC:L/Au:S/C:C/I:N/A:N) | May 14, 2019 | May 15, 2019 | Jan 24, 2025 |
Severity
5
CVSS
(AV:L/AC:L/Au:S/C:C/I:N/A:N)
Published
May 14, 2019
Added
May 15, 2019
Modified
Jan 24, 2025
Description
Microarchitectural Store Buffer Data Sampling (MSBDS): Store buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf
Modern Intel microprocessors implement hardware-level micro-optimizations to improve the performance of writing data back to CPU caches. The write operation is split into STA (STore Address) and STD (STore Data) sub-operations. These sub-operations allow the processor to hand-off address generation logic into these sub-operations for optimized writes. Both of these sub-operations write to a shared distributed processor structure called the 'processor store buffer'. As a result, an unprivileged attacker could use this flaw to read private data resident within the CPU's processor store buffer.
Modern Intel microprocessors implement hardware-level micro-optimizations to improve the performance of writing data back to CPU caches. The write operation is split into STA (STore Address) and STD (STore Data) sub-operations. These sub-operations allow the processor to hand-off address generation logic into these sub-operations for optimized writes. Both of these sub-operations write to a shared distributed processor structure called the 'processor store buffer'. As a result, an unprivileged attacker could use this flaw to read private data resident within the CPU's processor store buffer.
Solution(s)
oracle-linux-upgrade-kerneloracle-linux-upgrade-kernel-uek
References
- CVE-2018-12126
- https://attackerkb.com/topics/CVE-2018-12126
- ELSA-ELSA-2019-1181
- ELSA-ELSA-2019-1177
- ELSA-ELSA-2019-4637
- ELSA-ELSA-2019-1178
- ELSA-ELSA-2019-1167
- ELSA-ELSA-2019-4702
- ELSA-ELSA-2019-4636
- ELSA-ELSA-2019-4714
- ELSA-ELSA-2019-4629
- ELSA-ELSA-2019-4675
- ELSA-ELSA-2019-4640
- ELSA-ELSA-2019-4672
- ELSA-ELSA-2019-4630
- ELSA-ELSA-2019-1175
- ELSA-ELSA-2019-1180
- ELSA-ELSA-2019-1168
- ELSA-ELSA-2019-1169
- ELSA-ELSA-2019-4732
- ELSA-ELSA-2019-4643
- ELSA-ELSA-2019-4628

NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.