openSUSE Security Update : ucode-intel (openSUSE-2019-1402) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)

medium Nessus Plugin ID 125241
New! Plugin Severity Now Using CVSS v3

The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Synopsis

The remote openSUSE host is missing a security update.

Description

This update for ucode-intel fixes the following issues :

This update contains the Intel QSR 2019.1 Microcode release (bsc#1111331)

Four new speculative execution information leak issues have been identified in Intel CPUs. (bsc#1111331)

- CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS)

- CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS)

- CVE-2018-12130: Microarchitectural Load Port Data Samling (MLPDS)

- CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM)

These updates contain the CPU Microcode adjustments for the software mitigations.

For more information on this set of vulnerabilities, check out https://www.suse.com/support/kb/doc/?id=7023736

Release notes :

- Processor Identifier Version Products

- Model Stepping F-MO-S/PI Old->New

- ---- new platforms
----------------------------------------

- CLX-SP B1 6-55-7/bf 05000021 Xeon Scalable Gen2

- ---- updated platforms
------------------------------------

- SNB D2/G1/Q0 6-2a-7/12 0000002e->0000002f Core Gen2

- IVB E1/L1 6-3a-9/12 00000020->00000021 Core Gen3

- HSW C0 6-3c-3/32 00000025->00000027 Core Gen4

- BDW-U/Y E0/F0 6-3d-4/c0 0000002b->0000002d Core Gen5

- IVB-E/EP C1/M1/S1 6-3e-4/ed 0000042e->0000042f Core Gen3 X Series; Xeon E5 v2

- IVB-EX D1 6-3e-7/ed 00000714->00000715 Xeon E7 v2

- HSX-E/EP Cx/M1 6-3f-2/6f 00000041->00000043 Core Gen4 X series; Xeon E5 v3

- HSX-EX E0 6-3f-4/80 00000013->00000014 Xeon E7 v3

- HSW-U C0/D0 6-45-1/72 00000024->00000025 Core Gen4

- HSW-H C0 6-46-1/32 0000001a->0000001b Core Gen4

- BDW-H/E3 E0/G0 6-47-1/22 0000001e->00000020 Core Gen5

- SKL-U/Y D0/K1 6-4e-3/c0 000000c6->000000cc Core Gen6

- SKX-SP H0/M0/U0 6-55-4/b7 0200005a->0000005e Xeon Scalable

- SKX-D M1 6-55-4/b7 0200005a->0000005e Xeon D-21xx

- BDX-DE V1 6-56-2/10 00000019->0000001a Xeon D-1520/40

- BDX-DE V2/3 6-56-3/10 07000016->07000017 Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19

- BDX-DE Y0 6-56-4/10 0f000014->0f000015 Xeon D-1557/59/67/71/77/81/87

- BDX-NS A0 6-56-5/10 0e00000c->0e00000d Xeon D-1513N/23/33/43/53

- APL D0 6-5c-9/03 00000036->00000038 Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx

- SKL-H/S R0/N0 6-5e-3/36 000000c6->000000cc Core Gen6;
Xeon E3 v5

- DNV B0 6-5f-1/01 00000024->0000002e Atom Processor C Series

- GLK B0 6-7a-1/01 0000002c->0000002e Pentium Silver N/J5xxx, Celeron N/J4xxx

- AML-Y22 H0 6-8e-9/10 0000009e->000000b4 Core Gen8 Mobile

- KBL-U/Y H0 6-8e-9/c0 0000009a->000000b4 Core Gen7 Mobile

- CFL-U43e D0 6-8e-a/c0 0000009e->000000b4 Core Gen8 Mobile

- WHL-U W0 6-8e-b/d0 000000a4->000000b8 Core Gen8 Mobile

- WHL-U V0 6-8e-d/94 000000b2->000000b8 Core Gen8 Mobile

- KBL-G/H/S/E3 B0 6-9e-9/2a 0000009a->000000b4 Core Gen7;
Xeon E3 v6

- CFL-H/S/E3 U0 6-9e-a/22 000000aa->000000b4 Core Gen8 Desktop, Mobile, Xeon E

- CFL-S B0 6-9e-b/02 000000aa->000000b4 Core Gen8

- CFL-H/S P0 6-9e-c/22 000000a2->000000ae Core Gen9

- CFL-H R0 6-9e-d/22 000000b0->000000b8 Core Gen9 Mobile

This update was imported from the SUSE:SLE-15:Update update project.

Solution

Update the affected ucode-intel package.

See Also

https://bugzilla.opensuse.org/show_bug.cgi?id=1111331

https://www.suse.com/support/kb/doc/?id=7023736

Plugin Details

Severity: Medium

ID: 125241

File Name: openSUSE-2019-1402.nasl

Version: 1.4

Type: local

Agent: unix

Published: 5/17/2019

Updated: 1/19/2021

Dependencies: ssh_get_info.nasl

Risk Information

CVSS Score Source: CVE-2019-11091

VPR

Risk Factor: High

Score: 7.7

CVSS v2

Risk Factor: Medium

Base Score: 4.7

Temporal Score: 3.5

Vector: AV:L/AC:M/Au:N/C:C/I:N/A:N

Temporal Vector: E:U/RL:OF/RC:C

CVSS v3

Risk Factor: Medium

Base Score: 5.6

Temporal Score: 4.9

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Temporal Vector: E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:ucode-intel, cpe:/o:novell:opensuse:15.0

Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list, Host/cpu

Exploit Ease: No known exploits are available

Patch Publication Date: 5/16/2019

Vulnerability Publication Date: 5/30/2019

Reference Information

CVE: CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091