ASA-2019-00272 – FreeBSD: Microarchitectural Data Sampling (MDS)

Allele Security Alert

ASA-2019-00272

Identifier(s)

ASA-2019-00272, FreeBSD-SA-19:07.mds, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091

Title

Microarchitectural Data Sampling (MDS)

Vendor(s)

The FreeBSD Project

Product(s)

FreeBSD

Affected version(s)

All supported versions of FreeBSD

Fixed version(s)

2019-05-14 17:04:00 UTC (stable/12, 12.0-STABLE)
2019-05-14 23:19:08 UTC (releng/12.0, 12.0-RELEASE-p4)
2019-05-14 17:05:02 UTC (stable/11, 11.3-PRERELEASE)
2019-05-14 23:20:16 UTC (releng/11.2, 11.2-RELEASE-p10)

Proof of concept

Unknown

Description

Modern processors make use of speculative execution, an optimization technique which performs some action in advance of knowing whether the result will actually be used.

On some Intel processors utilizing speculative execution a local process may be able to infer stale information from microarchitectural buffers to obtain a memory disclosure.

An attacker may be able to read secret data from the kernel or from a process when executing untrusted code (for example, in a web browser).

Technical details

Unknown

Credits

Microarchitectural Store Buffer Data Sampling (MSBDS) – CVE-2018-12126: This vulnerability was found internally by Intel employees.  Intel would like to thank Ke Sun, Henrique Kawakami, Kekai Hu and Rodrigo Branco. It was independently reported by Lei Shi – Qihoo – 360 CERT and by Marina Minkin¹, Daniel Moghimi², Moritz Lipp³, Michael Schwarz³, Jo Van Bulck⁴, Daniel Genkin¹, Daniel Gruss³, Berk Sunar², Frank Piessens⁴, Yuval Yarom⁵ (¹University of Michigan, ²Worcester Polytechnic Institute, ³Graz University of Technology, ⁴imec-DistriNet, KU Leuven, ⁵University of Adelaide).

 

Microarchitectural Load Port Data Sampling (MLPDS) – CVE-2018-12127: This vulnerability was found internally by Intel employees and Microsoft. Intel would like to thank Brandon Falk – Microsoft Windows Platform Security Team, Ke Sun, Henrique Kawakami, Kekai Hu, and Rodrigo Branco – Intel. It was independently reported by Matt Miller – Microsoft, and by Stephan van Schaik, Alyssa Milburn, Sebastian Österlund, Pietro Frigo, Kaveh Razavi, Herbert Bos, and Cristiano Giuffrida – VUSec group at VU Amsterdam.

Microarchitectural Fill Buffer Data Sampling (MFBDS) – CVE-2018-12130: This vulnerability was found internally by Intel employees. Intel would like to thank Ke Sun, Henrique Kawakami, Kekai Hu and Rodrigo Branco. It was independently reported by Giorgi Maisuradze – Microsoft Research, and by Dan Horea Lutas, and Andrei Lutas – Bitdefender, and by Volodymyr Pikhur, and by Stephan van Schaik, Alyssa Milburn, Sebastian Österlund, Pietro Frigo, Kaveh Razavi, Herbert Bos, and Cristiano Giuffrida – VUSec group at VU Amsterdam, and by Moritz Lipp, Michael Schwarz, and Daniel Gruss – Graz University of Technology.

Microarchitectural Data Sampling Uncacheable Memory (MDSUM) – CVE-2019-11091: This vulnerability was found internally by Intel employees. Intel would like to thank Ke Sun, Henrique Kawakami, Kekai Hu and Rodrigo Branco. It was independently found by Volodrmyr Pikhur, and by Moritz Lipp, Michael Schwarz, Daniel Gruss – Graz University of Technology, and by Stephan van Schaik, Alyssa Milburn, Sebastian Österlund, Pietro Frigo, Kaveh Razavi, Herbert Bos, and Cristiano Giuffrida – VUSec group at VU Amsterdam.

Reference(s)

Microarchitectural Data Sampling (MDS)
https://www.freebsd.org/security/advisories/FreeBSD-SA-19:07.mds.asc

Microarchitectural Data Sampling Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00233.html

Side Channel Vulnerability Microarchitectural Data Sampling
https://www.intel.com/content/www/us/en/architecture-and-technology/mds.html

CVE-2018-12126
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12126

CVE-2018-12126
https://nvd.nist.gov/vuln/detail/CVE-2018-12126

CVE-2018-12127
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12127

CVE-2018-12127
https://nvd.nist.gov/vuln/detail/CVE-2018-12127

CVE-2018-12130
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12130

CVE-2018-12130
https://nvd.nist.gov/vuln/detail/CVE-2018-12130

CVE-2019-11091
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11091

CVE-2019-11091
https://nvd.nist.gov/vuln/detail/CVE-2019-11091

If there is any error in this alert or you wish a comprehensive analysis, let us know.

Last modified: May 15, 2019

We are not responsible for any data loss, device corruption or any other type of issue due to the use of any information mentioned in our security alerts.