Henrique Kawakami

**Name of the Vulnerable Software and Affected Versions** AMD processor microcode (affected versions not specified) **Description** The issue is related to the implementation of the Indirect Branch Prediction Barrier (IBPB) mechanism in AMD processor microcode, which may lead to a potential information disclosure due to incorrect clearing of the Return Address Stack (RAS). This could allow an attacker to obtain sensitive information using a side channel. The vulnerability is being actively exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AMD processors (affected versions not specified) **Description** A potential issue in AMD processors using frequency scaling may allow an authenticated attacker to execute a timing attack, potentially enabling information disclosure. The vulnerability is related to the implementation of Dynamic Voltage and Frequency Scaling (DVFS) in AMD processor microcode, which is associated with inadequate protection of physical side channels. Exploitation of the issue may allow a remote attacker to gain unauthorized access to protected information using a side channel. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AMD CPUs (affected versions not specified) **Description** The issue is related to the LFENCE/JMP module in AMD CPUs, specifically concerning the branch prediction mechanism. This allows an attacker to access protected memory from a program without the necessary privileges by exploiting indirect branch prediction. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Intel microprocessors (affected versions not specified) vCenter Server (affected versions not specified) ESXi (affected versions not specified) Workstation (affected versions not specified) Fusion (affected versions not specified) **Description** The issue is related to Microarchitectural Data Sampling Uncacheable Memory (MDSUM) on some microprocessors that utilize speculative execution. This may allow an authenticated user with local access to potentially enable information disclosure via a side channel. An attacker with local access to a targeted system may exploit this issue to obtain data on the targeted system, causing some information leakage. **Recommendations** For Intel microprocessors, apply the microcode updates as guided by Intel. For vCenter Server, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For ESXi, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For Workstation, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For Fusion, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities.

**Name of the Vulnerable Software and Affected Versions** Intel microprocessors (affected versions not specified) vCenter Server (affected versions not specified) ESXi (affected versions not specified) Workstation (affected versions not specified) Fusion (affected versions not specified) Huawei VRP (affected versions not specified) **Description** The issue is related to Microarchitectural Load Port Data Sampling (MLPDS), which may allow an authenticated user to potentially enable information disclosure via a side channel with local access. This is due to the incorrect implementation of saving outdated operation results in the load port table. The exploitation of this issue can allow an attacker to access confidential information. **Recommendations** For Intel microprocessors, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For vCenter Server, apply Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For ESXi, apply Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For Workstation, apply Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For Fusion, apply Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For Huawei VRP, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Intel Microprocessors (affected versions not specified) vCenter Server (affected versions not specified) ESXi (affected versions not specified) Workstation (affected versions not specified) Fusion (affected versions not specified) **Description** The issue is related to Microarchitectural Fill Buffer Data Sampling (MFBDS), which may allow an authenticated user to potentially enable information disclosure via a side channel with local access. This is due to the speculative execution utilized by some microprocessors. **Recommendations** For Intel Microprocessors, consider applying the microcode updates as guided by Intel to mitigate the risk. For vCenter Server, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For ESXi, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For Workstation, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For Fusion, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities.