Ke Sun

تتعلق المشكلة بعدم كفاية دقة التحكم في الوصول في البرنامج الثابت UEFI، مما قد يسمح لمستخدم معتمد بالتسبب في حدوث رفض الخدمة عبر الوصول المحلي.

The issue is related to improper Finite State Machines (FSMs) in the hardware logic of some Intel(R) Processors. This may allow a privileged user to potentially enable denial of service via local access.

A sequence of processor instructions can lead to unexpected behavior in some Intel processors, potentially allowing an authenticated user to enable escalation of privilege, information disclosure, or denial of service via local access. This issue is related to the interpretation of redundant prefixes and can cause the system to crash or become unresponsive. The vulnerability, termed Reptar, primarily affects multi-tenant virtualized environments where multiple virtual machines are run on the same host.

The issue is related to insufficient control flow management in the BIOS firmware for some Intel(R) Processors. This may allow a privileged user to potentially enable denial of service via local access.

The issue is related to insufficient protection of internal data in the Windows operating system, which can allow an attacker to gain unauthorized access to protected information. This can enable attackers to obtain sensitive information and affect the system.

The issue is related to the implementation of the Indirect Branch Prediction Barrier (IBPB) mechanism in AMD processor microcode, which may lead to a potential information disclosure due to incorrect clearing of the Return Address Stack (RAS). This could allow an attacker to obtain sensitive information using a side channel. The vulnerability is being actively exploited.

The issue is related to the incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors, which may allow an authenticated user to potentially enable information disclosure via local access. This vulnerability is associated with the disclosure of information and can be exploited by an attacker to reveal protected information.

The issue is related to the incomplete cleanup of multi-core shared buffers for some Intel(R) Processors, which may allow an authenticated user to potentially enable information disclosure via local access. This vulnerability is associated with the disclosure of information and can be exploited to reveal protected information.

The issue is related to improper clearance or release of resources in Intel processor microcode, which may allow an attacker to cause a denial of service. It involves improper input validation for some Intel processors, potentially enabling an authenticated user to cause a denial of service via local access.

A potential issue in AMD processors using frequency scaling may allow an authenticated attacker to execute a timing attack, potentially enabling information disclosure. The vulnerability is related to the implementation of Dynamic Voltage and Frequency Scaling (DVFS) in AMD processor microcode, which is associated with inadequate protection of physical side channels. Exploitation of the issue may allow a remote attacker to gain unauthorized access to protected information using a side channel.

The issue is related to incomplete cleanup in specific special register read operations, which may allow an authenticated user to potentially enable information disclosure via local access. This could allow an attacker to obtain sensitive information. The vulnerability is associated with the Intel Microcode and is related to the incomplete cleanup of temporary or auxiliary resources.

The issue is related to the LFENCE/JMP module in AMD CPUs, specifically concerning the branch prediction mechanism. This allows an attacker to access protected memory from a program without the necessary privileges by exploiting indirect branch prediction.

The issue is related to speculative execution of read and write operations, accessing memory using non-canonical addresses. This can potentially result in data leakage. The vulnerability may allow an attacker to disclose information about the kernel's address space using a side-channel attack. The issue is similar to the Meltdown vulnerability. Researchers have demonstrated the effectiveness of the attack, and it is estimated to impact various CPUs, including existing AMD CPUs and future Intel and Arm CPUs.

The issue is related to Microarchitectural Data Sampling Uncacheable Memory (MDSUM) on some microprocessors that utilize speculative execution. This may allow an authenticated user with local access to potentially enable information disclosure via a side channel. An attacker with local access to a targeted system may exploit this issue to obtain data on the targeted system, causing some information leakage.

The issue is related to Microarchitectural Fill Buffer Data Sampling (MFBDS), which may allow an authenticated user to potentially enable information disclosure via a side channel with local access. This is due to the speculative execution utilized by some microprocessors.

The issue is related to Microarchitectural Load Port Data Sampling (MLPDS), which may allow an authenticated user to potentially enable information disclosure via a side channel with local access. This is due to the incorrect implementation of saving outdated operation results in the load port table. The exploitation of this issue can allow an attacker to access confidential information.