Herbert Bos

A cross-privilege Spectre v2 vulnerability allows attackers to bypass all deployed mitigations, including the recent Fine(IBT), and to leak arbitrary Linux kernel memory on Intel systems. This issue is related to a new variant of the Spectre v2 attack, called Native Branch History Injection (BHI), which can be used to leak arbitrary kernel memory at 3.5 kB/sec. The vulnerability can be exploited by an unauthenticated attacker to leak privileged memory, bypassing existing Spectre mitigation techniques.

The issue is related to the `vt ioctl` function, specifically the `vt setactivate` call, where the `array index nospec` mechanism fails to properly sanitize an out-of-bounds value, leading to a transient integer underflow. The `vsa.console` value should be decreased first and then sanitized with `array index nospec` to prevent this issue.

Name of the Vulnerable Software and Affected Versions: Intel(R) Processors (affected versions not specified) Intel(R) Brand Verification Tool versions prior to 11.0.0.1225 Description: The issue concerns an observable response discrepancy in floating-point operations for some Intel(R) Processors, which may allow an authorized user to potentially enable information disclosure via local access. Additionally, improper permissions in the installer for the Intel(R) Brand Verification Tool may allow an authenticated user to potentially enable escalation of privilege via local access. Recommendations: For Intel(R) Processors, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Intel(R) Brand Verification Tool versions prior to 11.0.0.1225, update to version 11.0.0.1225 or later to resolve the issue.

The issue concerns potential floating point value injection in CPU products, which, when combined with software vulnerabilities related to speculative execution, can lead to the use of incorrect floating point results. This may cause data leakage due to the incorrect use of data from FPVI.

The issue is related to an observable response discrepancy that may allow an authorized user to potentially enable information disclosure via local access. This discrepancy can be exploited to gain access to confidential data.

The issue is related to a potential speculative code store bypass in CPU products, which, in conjunction with software vulnerabilities related to speculative execution of overwritten instructions, may cause incorrect speculation and could result in data leakage. Additionally, there is a vulnerability in the Xen hypervisor related to insufficient access control to ports, which could allow an attacker to access confidential data.

The issue is related to insufficient neutralization of special elements in a request, which may allow a remote attacker to access confidential data. It is also described as a transient execution vulnerability, specifically Floating Point Value Injection (FPVI), allowing an attacker to leak arbitrary memory addresses and potentially enabling JIT type confusion attacks.

The issue is related to cleanup errors in some data cache evictions for some Intel(R) Processors, which may allow an authenticated user to potentially enable information disclosure via local access. This is caused by a data leak from the L1D cache. The vulnerability can be exploited to disclose protected information. Researchers have found a new speculative execution vulnerability in Intel CPUs that could let attackers leak targeted sensitive data from the OS kernel, co-resident virtual machines, and even from Intel's secured SGX enclave.

The issue is related to cleanup errors in some Intel(R) processors, which may allow an authenticated user to potentially enable information disclosure via local access. This is connected to a leak in the store buffer of results from reading vector registers, which are modified during the execution of vector instructions. An attacker could exploit this to disclose protected information.

The issue is related to Microarchitectural Data Sampling Uncacheable Memory (MDSUM) on some microprocessors that utilize speculative execution. This may allow an authenticated user with local access to potentially enable information disclosure via a side channel. An attacker with local access to a targeted system may exploit this issue to obtain data on the targeted system, causing some information leakage.

The issue is related to Microarchitectural Load Port Data Sampling (MLPDS), which may allow an authenticated user to potentially enable information disclosure via a side channel with local access. This is due to the incorrect implementation of saving outdated operation results in the load port table. The exploitation of this issue can allow an attacker to access confidential information.

The issue is related to Microarchitectural Fill Buffer Data Sampling (MFBDS), which may allow an authenticated user to potentially enable information disclosure via a side channel with local access. This is due to the speculative execution utilized by some microprocessors.

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: A hardware vulnerability in GPU memory modules enables attackers to accelerate micro-architectural attacks through the use of the JavaScript WebGL API. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

An issue in the kernel ION subsystem could allow a local malicious application to execute arbitrary code within the context of the kernel, potentially leading to a local permanent device compromise. This may require reflashing the operating system to repair the device.