Linux admins -

Security is always about tradeoffs. The branch predictor component in modern CPUs is used to optimize performance by helping to predict execution paths during program runs. But even with all the Spectre mitigations in place, it was recently discovered that a race condition in this code could allow attackers to leak kernel memory, including accessing sensitive data, even between containers and virtual machines!

If you have a recent Intel processor, this impacts you, and since it operates at the hardware level, it requires a firmware update and kernel updates to protect you from these attacks.

I think this vulnerability underscores an evolution in hardware-based threats. Keep reading to learn more about this threat and more from our LinuxSecurity team.

You'll also learn about a critical validation flaw recently discovered in NVIDIA's TensorRT-LLM framework. This stealthy bug could allow attackers to inject code to gain access to other processes on your system.

If you found value in today’s newsletter, please share it with your friends! Do you have a Linux security-related topic you'd like to cover for our audience? We welcome contributions from passionate and insightful community members who share our love for Linux and security.

Yours in Open Source, 

Dv Signature Newsletter 2024 Esm W150

Dave Wreski

LinuxSecurity Founder

Intel Processors 

The Discovery 

A Branch Privilege Injection flaw threatening Intel processors (CVE-2024-45332) has been discovered. By exploiting this vulnerability, attackers can access arbitrary memory and read sensitive data stored outside their privilege domain.

Intel Microcode Esm W224

The Impact

This bug allows attackers to access kernel data or extract sensitive information from virtual machines.

 The Fix

Intel has released critical updates to address this issue. It is essential that all impacted admins update immediately to safeguard their systems and sensitive data.

Your Related Advisories:

[distro_list_1]

TensorRT-LLM

The Discovery 

A critical validation flaw was recently discovered in NVIDIA's TensorRT-LLM framework, a high-performance library designed to optimize and deploy large language models (LLMs) for production use.

Nvidia Esm W300

The Impact

This issue could allow attackers to inject code to gain access to other processes on your system.

 The Fix

Nvidia has released essential patch updates to fix this dangerous flaw. All impacted admins should update as soon as possible to protect the security of their systems and the confidentiality of their data.

Your Related Advisories:

[distro_list_2]