Alerts This Week
Warning Icon 1 619
Alerts This Week
Warning Icon 1 619

Mageia 6: MGASA-2019-0173 Critical: Intel MDS Attack Mitigation

mageia
Calendar Grey May 16, 2019
Dist Mageia Esm H88
MGASA-2019-0173 - Updated microcode packages fix security vulnerabilities Publication date: 16 May 2
This update provides the Intel 20190514 microcode release that adds the microcode side mitigations for the Microarchitectural Data Sampling (MDS, also called ZombieLoad attack) vul...

Summary

This update provides the Intel 20190514 microcode release that adds the microcode side mitigations for the Microarchitectural Data Sampling (MDS, also called ZombieLoad attack) vulnerabilities in Intel processors that can allow attackers to retrieve data being processed inside a CPU.
The fixed / mitigated issues are:
Modern Intel microprocessors implement hardware-level micro-optimizations to improve the performance of writing data back to CPU caches. The write operation is split into STA (STore Address) and STD (STore Data) sub-operations. These sub-operations allow the processor to hand-off address generation logic into these sub-operations for optimized writes. Both of these sub-operations write to a shared distributed processor structure called the 'processor store buffer'. As a result, an unprivileged attacker could use this flaw to read private data resident within the CPU's processor store buffer. (CVE-2018-12126)
Microprocessors use a ‘load port’ subcomponent to perfor...

Read the Full Advisory

References

- https://bugs.mageia.org/show_bug.cgi?id=24800

- https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html

- https://www.cve.org/CVERecord?id=CVE-2018-12126

- https://www.cve.org/CVERecord?id=CVE-2018-12127

- https://www.cve.org/CVERecord?id=CVE-2018-12130

- https://www.cve.org/CVERecord?id=CVE-2019-11091

Resolution

SRPMS

- 6/nonfree/microcode-0.20190514-1.mga6.nonfree

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 16 May 2019
URL: https://advisories.mageia.org/MGASA-2019-0173.html
Type: security
CVE: CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here