Americas

  • United States
sandra_henrystocker
Unix Dweeb

Red Hat Responds to Zombieload v2

News
Nov 13, 20193 mins
Computers and PeripheralsLinuxSecurity

Red Hat calls for updating Linux software to address Intel processor flaws that can lead to data-theft exploits

20151027 red hat logo
Credit: Stephen Lawson/IDG

Three Common Vulnerabilities and Exposures (CVEs) opened yesterday track three flaws in certain Intel processors, which, if exploited, can put sensitive data at risk.

Of the flaws reported, the newly discovered Intel processor flaw is a variant of the Zombieload attack discovered earlier this year and is only known to affect Intel’s Cascade Lake chips.

Red Hat strongly suggests that all Red Hat systems be updated even if they do not believe their configuration poses a direct threat, and it is providing resources to their customers and to the enterprise IT community.

The three CVEs are:

  • CVE-2018-12207 – Machine Check Error on Page Size Change
  • CVE-2019-11135 – TSX Asynchronous Abort
  • CVE-2019-0155 and CVE-2019-0154 – i915 graphics driver

CVE-2018-12207

Red Hat rates this vulnerability as important. It is a vulnerability that could allow a local and unprivileged attacker to bypass security controls and cause a system-wide denial of service.

The hardware flaw was found in Intel microprocessors and is related to the Instruction Translation Lookaside Buffer (ITLB). It caches translations from virtual to physical addresses and is intended to improve performance. However, a delay in invalidating cached entries after cache page changes could lead to a processor using an invalid address translation causing a machine check error exception and moving the system into a hang state.

This kind of scenario could be crafted by an attacker to take a system down.

CVE-2019-11135

Red Hat rates this vulnerability as moderate. This Transactional Synchronization Extensions (TSX) Asynchronous Abort is a Microarchitectural Data Sampling (MDS) flaw. A local attacker using custom code could use this flaw to gather information from cache contents on the processor and processors that support simultaneous multithreading (SMT) and TSX.

CVE-2019-0155, CVE-2019-0154

Red Hat rates the CVE-2019-0155 flaw as important and the CVE-2019-0154 as moderate. Both flaws are related to the i915 graphics driver.

CVE-2019-0155 allows allows an attacker to bypass conventional memory security restrictions, allowing write access to privileged memory that ought to be restricted.

CVE-2019-0154 could allow an local attacker to create an invalid system state when the Graphics Processing Unit (GPU) is in low power mode, leading to the system becoming inaccessible.

The only affected graphics card affected by CVE-2019-0154 is on the i915 kernel module. The lsmod command can be used to indicate vulnerability. Any output like that shown below (i.e., starting with i915) indicates that this system is vulnerable:

$ lsmod | grep ^i915
i915          2248704 10

Additional resources

Red Hat has provided details and further instructions to its customers and others in the following links:

https://access.redhat.com/security/vulnerabilities/ifu-page-mce

https://access.redhat.com/solutions/tsx-asynchronousabort

https://access.redhat.com/solutions/i915-graphics

sandra_henrystocker
Unix Dweeb

Sandra Henry-Stocker has been administering Unix systems for more than 30 years. She describes herself as "USL" (Unix as a second language) but remembers enough English to write books and buy groceries. She lives in the mountains in Virginia where, when not working with or writing about Unix, she's chasing the bears away from her bird feeders.

The opinions expressed in this blog are those of Sandra Henry-Stocker and do not necessarily represent those of IDG Communications, Inc., its parent, subsidiary or affiliated companies.