Windows 10: Intel DDIO and RDMA Partial Information Disclosure Advisory

Brink · Sep 10, 2019

Intel ID: INTEL-SA-00290 Advisory Category: Hardware Impact of vulnerability: Information Disclosure Severity rating: LOW Original release: 09/10/2019 Last revised: 09/10/2019
Summary:

A potential security vulnerability in some microprocessors with Intel® Data Direct I/O Technology (Intel® DDIO) and Remote Direct Memory Access (RDMA) may allow partial information disclosure via adjacent access.

Vulnerability Details:

CVEID: CVE-2019-11184
Description: A race condition in specific microprocessors using Intel (R) DDIO cache allocation and RDMA may allow an authenticated user to potentially enable partial information disclosure via adjacent access.
CVSS Base Score: 2.6 Low
CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N

Affected Products:

Intel® Xeon® E5, E7 and SP families that support DDIO and RDMA.

Recommendations:

Partial information potentially disclosed through exploitation of this vulnerability could be utilized to enhance unrelated attack methods. For published exploits that Intel is aware of, Intel recommends users follow existing best practices including:

Where DDIO & RDMA are enabled, limit direct access from untrusted networks.

The use of software modules resistant to timing attacks, using constant-time style code.

Security Best Practices For Side Channel Resistance:
Security Best Practices for Side Channel Resistance

Guidelines For Mitigating Timing Side Channels Against Cryptographic Implementations:
Guidelines for Mitigating Timing Side Channels Against Cryptographic Implementations

Acknowledgements:

Intel would like to thank Michael Kurth, Ben Gras, Dennis Andriesse, Cristiano Giuffrida, Herbert Bos, and Kaveh Razavi from VU Amsterdam for reporting this issue.

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are available.

Revision History

Revision Date Description 1.0 09/10/2019 Initial Release
Click to expand...

Source: INTEL-SA-00290

:)

Brink · Sep 10, 2019

Partial Physical Address Leakage in Specific Intel Processors Advisory

[table][tr]Intel ID: INTEL-SA-00247 [/tr] [tr][td]Advisory Category:[/td] [td]Hardware[/td] [/tr] [tr][td]Impact of vulnerability:[/td] [td]Information Disclosure[/td] [/tr] [tr][td]Severity rating:[/td] [td]LOW[/td] [/tr] [tr][td]Original release:[/td] [td]06/11/2019[/td] [/tr] [tr][td]Last revised:[/td] [td]06/11/2019[/td] [/tr] [/table]

Summary:

A potential security vulnerability in some microprocessors may allow partial information disclosure via local access.

Vulnerability Details:

CVEID: CVE-2019-0174
Description: Logic condition in specific microprocessors may allow an authenticated user to potentially enable partial physical address information disclosure via local access.
CVSS Base Score: 3.8 Low
CVSS Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Affected Products:

Microprocessors:
Intel® Core™ X-series Processors, 4th Generation Intel® Core™ i5 Processors,4th Generation Intel® Core™ i3 Processors, Intel® Pentium® Processor G Series, Intel® Pentium® Processor 3000 Series, Intel® Celeron® Processor 2000 Series, Intel® Xeon® Processor E7 v3 Family, Intel® Xeon® Processor E5 v3 Family, Intel® Xeon® Processor E3 v3 Family.

Recommendations:

Partial physical address information potentially disclosed through exploitation of this vulnerability does not contain user secrets, but could potentially be utilized to enhance unrelated attack methods. For published exploits that Intel is aware of, Intel recommends users follow existing best practices including:

The use of DRAM modules resistant to Rowhammer style attacks.

Security Best Practices For Side Channel Resistance:

Security Best Practices for Side Channel Resistance

Guidelines For Mitigating Timing Side Channels Against Cryptographic Implementations:

Guidelines for Mitigating Timing Side Channels Against Cryptographic Implementations

Acknowledgements:

Intel would like to thank Andrew Kwong, Daniel Genkin from University of Michigan and Daniel Gruss from Graz University of Technology and Yuval Yarom from University of Adelaide and Data61 for reporting this issue.

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are available.

Revision History

[table][tr]Revision Date Description [/tr] [tr][td]1.0[/td] [td]06/11/2019[/td] [td]Initial Release[/td] [/tr] [/table]
Click to expand...

Source: INTEL-SA-00247

Brink · Sep 10, 2019

Intel Integrated Performance Primitives (Intel IPP) Advisory

[table][tr]Intel ID: INTEL-SA-00202 [/tr] [tr][td]Advisory Category:[/td] [td]Software[/td] [/tr] [tr][td]Impact of vulnerability:[/td] [td]Information Disclosure[/td] [/tr] [tr][td]Severity rating:[/td] [td] MEDIUM[/td] [/tr] [tr][td]Original release:[/td] [td]12/05/2018[/td] [/tr] [tr][td]Last revised:[/td] [td]12/05/2018[/td] [/tr] [/table]

Summary:

A potential security vulnerability in Intel® IPP may allow information disclosure. Intel is releasing software updates to mitigate this potential vulnerability.

Vulnerability Details:

CVEID: CVE-2018-12155

Description: Data leakage in cryptographic libraries for Intel(R) IPP before 2019 update1 release may allow an authenticated user to potentially enable information disclosure via local access.

CVSS Base Score: 4.7 Medium

CVSS Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected Products:

Intel® IPP releases before 2019 update1.

Recommendations:

Intel recommends that users of Intel® IPP update to 2019 update1 or later.

Updates are available for download at this location: Home | Intel® Integrated Performance Primitives

Acknowledgements:

Intel would like to thank an Wichelmann (Universität zu Lübeck), Ahmad Moghimi (Worcester Polytechnic Institute), Thomas Eisenbarth (Universität zu Lübeck) and Berk Sunar (Worcester Polytechnic Institute) for reporting this issue and working with us on coordinated disclosure.

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are deployed.

Revision History

[table][tr]Revision Date Description [/tr] [tr][td]1.0[/td] [td]12/05/2918[/td] [td]Initial Release[/td] [/tr] [/table]
Click to expand...

Source: INTEL-SA-simple-template

Brink · Sep 10, 2019

Intel Computing Improvement Program Vulnerability Advisory

[table][tr]Intel ID: INTEL-SA-00283 [/tr] [tr][td]Advisory Category:[/td] [td]Software[/td] [/tr] [tr][td]Impact of vulnerability:[/td] [td]Escalation of Privilege, Denial of Service, Information Disclosure[/td] [/tr] [tr][td]Severity rating:[/td] [td]HIGH[/td] [/tr] [tr][td]Original release:[/td] [td]08/13/2013[/td] [/tr] [tr][td]Last revised:[/td] [td]08/13/2013[/td] [/tr] [/table]

Summary:

A potential security vulnerability in the Intel® Computing Improvement Program may allow escalation of privilege, denial of service or information disclosure. Intel is releasing software updates to mitigate this potential vulnerability.

Vulnerability Details:

CVEID: CVE-2019-11162
Description: Insufficient access control in hardware abstraction in SEMA driver for Intel(R) Computing Improvement Program before version 2.4.0.04733 may allow an authenticated user to potentially enable escalation of privilege, denial of service or information disclosure via local access.
CVSS Base Score: 8.2 High
CVSS Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Affected Products:

Intel® Computing Improvement Program before version 2.4.0.04733.

Recommendations:

Intel recommends that users of the Intel® Computing Improvement Program update to the latest version.

Updates are available for download at this location: Download Intel(R) Computing Improvement Program

Acknowledgements:

Intel would like to thank Jesse Michael (CVE-2019-11163) for reporting this issue.

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are available.

Revision History

[table][tr]Revision Date Description [/tr] [tr][td]1.0[/td] [td]08/13/2019[/td] [td]Initial Release[/td] [/tr] [/table]
Click to expand...

Source: INTEL-SA-00283

Windows 10: Intel DDIO and RDMA Partial Information Disclosure Advisory

Intel DDIO and RDMA Partial Information Disclosure Advisory

Intel DDIO and RDMA Partial Information Disclosure Advisory

Intel DDIO and RDMA Partial Information Disclosure Advisory

Intel DDIO and RDMA Partial Information Disclosure Advisory - Similar Threads - Intel DDIO RDMA

Intel NUC Vulnerability Advisory

CVE-2019-1125 Windows Kernel Information Disclosure Vulnerability

Intel NUC Firmware Advisory

Partial Physical Address Leakage in Specific Intel Processors Advisory

Intel Accelerated Storage Manager in Intel RSTe Advisory

Intel Integrated Performance Primitives (Intel IPP) Advisory

Windows Audio Service Information Disclosure Vulnerability

Intel Extreme Tuning Utility Advisory

Intel NUC Firmware Security Advisory

Users found this page by searching for:

DDIO & RDMA