diff options
author | Ben Hutchings <ben@decadent.org.uk> | 2020-06-08 23:17:18 +0100 |
---|---|---|
committer | Ben Hutchings <ben@decadent.org.uk> | 2020-06-08 23:17:18 +0100 |
commit | 718bc634707f669dfa6c61b4373a4a25b1a5e447 (patch) | |
tree | 4b7b00e29a9d4bed4c92602edbe52b0f0df1ca3e /dsa-texts/4.19.118-2+deb10u1 | |
parent | 5f61e7fa7c9ac2d182e1383acb518a2521a1d834 (diff) |
dsa-texts: Improve description of CVE-2020-0543 (SRBDS)
* The vulnerability is in Intel CPUs, not anywhere else in the system
* The speculative execution could be on other cores or (so far as I
can see) on the same core
* The information leakage depends on the application, so say 'such as'
instead of 'including'
Diffstat (limited to 'dsa-texts/4.19.118-2+deb10u1')
-rw-r--r-- | dsa-texts/4.19.118-2+deb10u1 | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/dsa-texts/4.19.118-2+deb10u1 b/dsa-texts/4.19.118-2+deb10u1 index 016e45ab..ee247f00 100644 --- a/dsa-texts/4.19.118-2+deb10u1 +++ b/dsa-texts/4.19.118-2+deb10u1 @@ -33,13 +33,13 @@ CVE-2019-19462 CVE-2020-0543 - Researchers at VU Amsterdam discovered that on some Intel x86 - systems supporting the RDRAND and RDSEED instructions, speculative - execution may use part of a random value that was previously - generated for use on another core. Depending on how these - instructions are used by applications, a local user or VM guest - could use this to obtain sensitive information including - cryptographic keys from other users or VMs. + Researchers at VU Amsterdam discovered that on some Intel CPUs + supporting the RDRAND and RDSEED instructions, part of a random + value generated by these instructions may be used in a later + speculative execution on any core of the same physical CPU. + Depending on how these instructions are used by applications, a + local user or VM guest could use this to obtain sensitive + information such as cryptographic keys from other users or VMs. This vulnerability can be mitigated by a microcode update, either as part of system firmware (BIOS) or through the intel-microcode |