[ASA-202006-10] intel-ucode: information disclosure

[Remi Gacogne]

Arch Linux Security Advisory ASA-202006-10
==========================================

Severity: High
Date    : 2020-06-13
CVE-ID  : CVE-2020-0543 CVE-2020-0548 CVE-2020-0549
Package : intel-ucode
Type    : information disclosure
Remote  : No
Link    : https://security.archlinux.org/AVG-1187

Summary
=======

The package intel-ucode before version 20200609-1 is vulnerable to
information disclosure.

Resolution
==========

Upgrade to 20200609-1.

# pacman -Syu "intel-ucode>=20200609-1"

The problems have been fixed upstream in version 20200609.

Workaround
==========

None.

Description
===========

- CVE-2020-0543 (information disclosure)

A new domain bypass transient execution attack known as Special
Register Buffer Data Sampling (SRBDS) has been found. This flaw allows
data values from special internal registers to be leaked by an attacker
able to execute code on any core of the CPU. An unprivileged, local
attacker can use this flaw to infer values returned by affected
instructions known to be commonly used during cryptographic operations
that rely on uniqueness, secrecy, or both.

- CVE-2020-0548 (information disclosure)

A flaw was found in Intel processors where a local attacker is able to
gain information about registers used for vector calculations by
observing register states from other processes running on the system.
This results in a race condition where store buffers, which were not
cleared, could be read by another process or a CPU sibling. The highest
threat from this vulnerability is data confidentiality where an
attacker could read arbitrary data as it passes through the processor.

- CVE-2020-0549 (information disclosure)

A microarchitectural timing flaw was found on some Intel processors. A
corner case exists where data in-flight during the eviction process can
end up in the “fill buffers” and not properly cleared by the MDS
mitigations. The fill buffer contents (which were expected to be blank)
can be inferred using MDS or TAA style attack methods to allow a local
attacker to infer fill buffer values.

Impact
======

A local unprivileged attacker with access to an affected CPU can read
protected memory through a shared buffer on an SGX enclave or CPU core.

References
==========

https://software.intel.com/security-software-guidance/insights/deep-dive-special-register-buffer-data-sampling
https://blogs.intel.com/technology/2020/06/ipas-security-advisories-for-june-2020/#gs.6uyhri
https://cacheoutattack.com/CacheOut.pdf
https://software.intel.com/security-software-guidance/software-guidance/l1d-eviction-sampling
https://blogs.intel.com/technology/2020/01/ipas-intel-sa-00329/
https://access.redhat.com/solutions/l1d-cache-eviction-and-vector-register-sampling
https://security.archlinux.org/CVE-2020-0543
https://security.archlinux.org/CVE-2020-0548
https://security.archlinux.org/CVE-2020-0549

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20200616/91fe8388/attachment.sig>