Kaveh Razavi

**Name of the Vulnerable Software and Affected Versions** AMD CPUs (affected versions not specified) AMD Zen CPUs (affected versions not specified) AMD Zen1 to Zen4 CPUs (affected versions not specified) **Description** A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in speculative execution at an attacker-controlled address, potentially leading to information disclosure. The vulnerability, also known as Inception, is a novel transient execution attack that leaks arbitrary data on all AMD Zen CPUs in the presence of all previously deployed software- and hardware mitigations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AMD processors (affected versions not specified) **Description** The issue is related to aliases in the branch predictor of some AMD processors, which may cause them to predict the wrong branch type. This could potentially lead to information disclosure. The vulnerability is associated with incorrect branch type prediction, allowing an attacker to disclose protected information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Intel and AMD microprocessors (affected versions not specified) AMD microprocessor families 15h through 18h **Description** The issue is related to mis-trained branch predictions for return instructions, which may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions. This can lead to the disclosure of protected information from kernel memory or enable an attack on the host system from virtual machines. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution. **Recommendations** For Intel and AMD microprocessors, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For AMD microprocessor families 15h through 18h, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Intel(R) Processors (affected versions not specified) **Description** The issue is related to an unprotected alternative channel of return branch target prediction in some Intel(R) Processors, which may allow an authorized user to potentially enable information disclosure via local access. The RSBA behavior allows alternate branch predictors to be used by near RET instructions when the RSB is empty. When eIBRS is enabled, the predicted target of these alternate predictors are restricted to those belonging to the indirect branch predictor entries of the current prediction domain. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Intel microprocessor generations 6 through 8 **Description** The issue is related to errors in processing the `ret` instruction, which retrieves an address for transition from the stack. This can allow an attacker to disclose protected information from kernel memory or launch an attack on the host system from virtual machines. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions. **Recommendations** For Intel microprocessor generations 6 through 8, consider disabling the use of the `ret` instruction in sensitive code paths until a patch is available. Restrict access to kernel memory to minimize the risk of exploitation. As a temporary workaround, apply configuration changes to mitigate the risk of arbitrary speculative code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to the `vt ioctl` function, specifically the `vt setactivate` call, where the `array index nospec` mechanism fails to properly sanitize an out-of-bounds value, leading to a transient integer underflow. The `vsa.console` value should be decreased first and then sanitized with `array index nospec` to prevent this issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Intel(R) Processors (affected versions not specified) **Description** The issue is related to cleanup errors in some Intel(R) processors, which may allow an authenticated user to potentially enable information disclosure via local access. This is connected to a leak in the store buffer of results from reading vector registers, which are modified during the execution of vector instructions. An attacker could exploit this to disclose protected information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Intel(R) Processors (affected versions not specified) **Description** The issue is related to cleanup errors in some data cache evictions for some Intel(R) Processors, which may allow an authenticated user to potentially enable information disclosure via local access. This is caused by a data leak from the L1D cache. The vulnerability can be exploited to disclose protected information. Researchers have found a new speculative execution vulnerability in Intel CPUs that could let attackers leak targeted sensitive data from the OS kernel, co-resident virtual machines, and even from Intel's secured SGX enclave. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Intel microprocessors (affected versions not specified) vCenter Server (affected versions not specified) ESXi (affected versions not specified) Workstation (affected versions not specified) Fusion (affected versions not specified) **Description** The issue is related to Microarchitectural Data Sampling Uncacheable Memory (MDSUM) on some microprocessors that utilize speculative execution. This may allow an authenticated user with local access to potentially enable information disclosure via a side channel. An attacker with local access to a targeted system may exploit this issue to obtain data on the targeted system, causing some information leakage. **Recommendations** For Intel microprocessors, apply the microcode updates as guided by Intel. For vCenter Server, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For ESXi, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For Workstation, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For Fusion, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities.

**Name of the Vulnerable Software and Affected Versions** Intel Microprocessors (affected versions not specified) vCenter Server (affected versions not specified) ESXi (affected versions not specified) Workstation (affected versions not specified) Fusion (affected versions not specified) **Description** The issue is related to Microarchitectural Fill Buffer Data Sampling (MFBDS), which may allow an authenticated user to potentially enable information disclosure via a side channel with local access. This is due to the speculative execution utilized by some microprocessors. **Recommendations** For Intel Microprocessors, consider applying the microcode updates as guided by Intel to mitigate the risk. For vCenter Server, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For ESXi, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For Workstation, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For Fusion, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities.

**Name of the Vulnerable Software and Affected Versions** Intel microprocessors (affected versions not specified) vCenter Server (affected versions not specified) ESXi (affected versions not specified) Workstation (affected versions not specified) Fusion (affected versions not specified) Huawei VRP (affected versions not specified) **Description** The issue is related to Microarchitectural Load Port Data Sampling (MLPDS), which may allow an authenticated user to potentially enable information disclosure via a side channel with local access. This is due to the incorrect implementation of saving outdated operation results in the load port table. The exploitation of this issue can allow an attacker to access confidential information. **Recommendations** For Intel microprocessors, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For vCenter Server, apply Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For ESXi, apply Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For Workstation, apply Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For Fusion, apply Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For Huawei VRP, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: A hardware vulnerability in GPU memory modules enables attackers to accelerate micro-architectural attacks through the use of the JavaScript WebGL API. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions 2.6.32 through 4.x **Description** The issue is related to the Kernel Samepage Merging (KSM) component in the Linux kernel, which does not prevent the use of a write-timing side channel. This allows guest OS users to defeat the Address Space Layout Randomization (ASLR) protection mechanism on other guest OS instances via a Cross-VM ASL Introspection (CAIN) attack. The vendor suggests disabling deduplication to mitigate this attack vector. This issue can be classified as a potentially misunderstood behavior rather than a vulnerability, as share-until-written approaches for memory conservation among mutually untrusting tenants are inherently detectable for information disclosure. **Recommendations** For Linux kernel versions 2.6.32 through 4.x, consider disabling deduplication to mitigate the risk of exploitation. As a temporary workaround, restrict the use of the Kernel Samepage Merging (KSM) component until a more comprehensive solution is available.

**Name of the Vulnerable Software and Affected Versions** Android versions prior to 2016-11-05 **Description** An issue in the kernel ION subsystem could allow a local malicious application to execute arbitrary code within the context of the kernel, potentially leading to a local permanent device compromise. This may require reflashing the operating system to repair the device. **Recommendations** For versions prior to 2016-11-05, update the Android operating system to a version released on or after 2016-11-05 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Pablo Software Solutions Quick 'n Easy FTP Server Professional and Lite version 3.0 **Description** The issue is related to a buffer overflow in Unicode processing within the logging functionality. This can be triggered by sending a command with a long argument, which then causes a buffer overflow when an admin selects the Logging section in the FTP server main window, potentially allowing remote authenticated users to execute arbitrary code. **Recommendations** For version 3.0, consider disabling the logging functionality until a fix is available to prevent potential exploitation. Restrict access to the FTP server main window's Logging section to minimize the risk of triggering the buffer overflow. Avoid using long arguments in commands to the FTP server to reduce the likelihood of exploitation.

**Name of the Vulnerable Software and Affected Versions** EcommPro version 3.0 **Description** The issue allows remote attackers to execute arbitrary SQL commands via the `password` field in the login.asp file. This can potentially lead to unauthorized access and data manipulation. **Recommendations** For EcommPro version 3.0, consider validating and sanitizing user input in the `password` field to prevent SQL injection attacks. As a temporary workaround, restrict access to the login.asp file until a proper fix is applied.