An update for qemu-kvm is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.

Security Fix(es) :

* A flaw was found in the implementation of the 'fill buffer', a mechanism used by modern CPUs when a cache-miss is made on L1 CPU cache. If an attacker can generate a load operation that would create a page fault, the execution will continue speculatively with incorrect data from the fill buffer while the data is fetched from higher level caches. This response time can be measured to infer data in the fill buffer. (CVE-2018-12130)

* Modern Intel microprocessors implement hardware-level micro-optimizations to improve the performance of writing data back to CPU caches. The write operation is split into STA (STore Address) and STD (STore Data) sub-operations. These sub-operations allow the processor to hand-off address generation logic into these sub-operations for optimized writes. Both of these sub-operations write to a shared distributed processor structure called the 'processor store buffer'. As a result, an unprivileged attacker could use this flaw to read private data resident within the CPU's processor store buffer. (CVE-2018-12126)

* Microprocessors use a aEUR~load portaEURtm subcomponent to perform load operations from memory or IO. During a load operation, the load port receives data from the memory or IO subsystem and then provides the data to the CPU registers and operations in the CPUaEURtms pipelines.
Stale load operations results are stored in the 'load port' table until overwritten by newer operations. Certain load-port operations triggered by an attacker can be used to reveal data about previous stale requests leaking data back to the attacker via a timing side-channel. (CVE-2018-12127)

* Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access.
(CVE-2019-11091)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The 5.0.16 stable updates contain a number of important fixes across the tree. Most importantly, these updates address the kernel portion of the MDS CVEs.

----

The 5.0.14 update contains a number of important fixes across the tree.

There is no kernel-headers or kernel-tools build this time.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1200 advisory.

    KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of     architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines     that use KVM in environments managed by Red Hat products.

    Security Fix(es):

    * A flaw was found in the implementation of the fill buffer, a mechanism used by modern CPUs when a     cache-miss is made on L1 CPU cache. If an attacker can generate a load operation that would create a page     fault, the execution will continue speculatively with incorrect data from the fill buffer while the data     is fetched from higher level caches. This response time can be measured to infer data in the fill buffer.
    (CVE-2018-12130)

    * Modern Intel microprocessors implement hardware-level micro-optimizations to improve the performance of     writing data back to CPU caches. The write operation is split into STA (STore Address) and STD (STore     Data) sub-operations. These sub-operations allow the processor to hand-off address generation logic into     these sub-operations for optimized writes. Both of these sub-operations write to a shared distributed     processor structure called the 'processor store buffer'. As a result, an unprivileged attacker could use     this flaw to read private data resident within the CPU's processor store buffer. (CVE-2018-12126)

    * Microprocessors use a load port subcomponent to perform load operations from memory or IO. During     a load operation, the load port receives data from the memory or IO subsystem and then provides the data     to the CPU registers and operations in the CPUs pipelines. Stale load operations results are stored in     the 'load port' table until overwritten by newer operations. Certain load-port operations triggered by an     attacker can be used to reveal data about previous stale requests leaking data back to the attacker via a     timing side-channel. (CVE-2018-12127)

    * Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated     user to potentially enable information disclosure via a side channel with local access. (CVE-2019-11091)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- Microarchitectural Store Buffer Data Sampling (MSBDS)     (CVE-2018-12126)

  - Microarchitectural Fill Buffer Data Sampling (MFBDS)     (CVE-2018-12130)

  - Microarchitectural Load Port Data Sampling (MLPDS)     (CVE-2018-12127)

  - Microarchitectural Data Sampling Uncacheable Memory     (MDSUM) (CVE-2019-11091)

MSBDS leaks Store Buffer Entries which can be speculatively forwarded to a dependent load (store-to-load forwarding) as an optimization. The forward can also happen to a faulting or assisting load operation for a different memory address, which can cause an issue under certain conditions. Store buffers are partitioned between Hyper-Threads so cross thread forwarding is not possible. But if a thread enters or exits a sleep state the store buffer is repartitioned which can expose data from one thread to the other.

MFBDS leaks Fill Buffer Entries. Fill buffers are used internally to manage L1 miss situations and to hold data which is returned or sent in response to a memory or I/O operation. Fill buffers can forward data to a load operation and also write data to the cache. When the fill buffer is deallocated it can retain the stale data of the preceding operations which can then be forwarded to a faulting or assisting load operation, which can cause an issue under certain conditions. Fill buffers are shared between Hyper-Threads so cross thread leakage is possible.

MLDPS leaks Load Port Data. Load ports are used to perform load operations from memory or I/O. The received data is then forwarded to the register file or a subsequent operation. In some implementations the Load Port can contain stale data from a previous operation which can be forwarded to faulting or assisting loads under certain conditions, which again can cause an issue eventually. Load ports are shared between Hyper-Threads so cross thread leakage is possible.

This update ships updated CPU microcode for most types of Intel CPUs.
It provides mitigations for the MSBDS, MFBDS, MLPDS and MDSUM hardware vulnerabilities.

To fully resolve these vulnerabilities it is also necessary to update the Linux kernel packages as released in DSA 4444.

Modern Intel microprocessors implement hardware-level micro-optimizations to improve the performance of writing data back to CPU caches. The write operation is split into STA (STore Address) and STD (STore Data) sub-operations. These sub-operations allow the processor to hand-off address generation logic into these sub-operations for optimized writes. Both of these sub-operations write to a shared distributed processor structure called the 'processor store buffer'. As a result, an unprivileged attacker could use this flaw to read private data resident within the CPU's processor store buffer.(CVE-2018-12126)

Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access.(CVE-2019-11091)

Microprocessors use a load port subcomponent to perform load operations from memory or IO. During a load operation, the load port receives data from the memory or IO subsystem and then provides the data to the CPU registers and operations in the CPUs pipelines. Stale load operations results are stored in the 'load port' table until overwritten by newer operations. Certain load-port operations triggered by an attacker can be used to reveal data about previous stale requests leaking data back to the attacker via a timing side-channel.(CVE-2018-12127)

A flaw was found in the implementation of the 'fill buffer', a mechanism used by modern CPUs when a cache-miss is made on L1 CPU cache. If an attacker can generate a load operation that would create a page fault, the execution will continue speculatively with incorrect data from the fill buffer while the data is fetched from higher level caches. This response time can be measured to infer data in the fill buffer.(CVE-2018-12130)

The remote Windows host is missing security update 4494440. It is, therefore, affected by multiple vulnerabilities :

  - A new subclass of speculative execution side channel vulnerabilities,     known as Microarchitectural Data Sampling, exist in Windows.
    An attacker who successfully exploited these vulnerabilities     may be able to read privileged data across trust boundaries.     In shared resource environments (such as exists in some cloud     services configurations), these vulnerabilities could allow     one virtual machine to improperly access information from     another. In non-browsing scenarios on standalone systems, an     attacker would need prior access to the system or an ability     to run a specially crafted application on the target system     to leverage these vulnerabilities.
    (CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091)

  - A security feature bypass vulnerability exists when     urlmon.dll improperly handles certain Mark of the Web     queries. The vulnerability allows Internet Explorer to     bypass Mark of the Web warnings or restrictions for     files downloaded or created in a specific way.
    (CVE-2019-0995)

  - A remote code execution vulnerability exists in the way     that Microsoft browsers access objects in memory. The     vulnerability could corrupt memory in a way that could     allow an attacker to execute arbitrary code in the     context of the current user. An attacker who     successfully exploited the vulnerability could gain the     same user rights as the current user.  (CVE-2019-0940)

  - A remote code execution vulnerability exists when the     Windows Jet Database Engine improperly handles objects     in memory. An attacker who successfully exploited this     vulnerability could execute arbitrary code on a victim     system. An attacker could exploit this vulnerability by     enticing a victim to open a specially crafted file. The     update addresses the vulnerability by correcting the way     the Windows Jet Database Engine handles objects in     memory. (CVE-2019-0889, CVE-2019-0890, CVE-2019-0891,     CVE-2019-0893, CVE-2019-0894, CVE-2019-0895,     CVE-2019-0896, CVE-2019-0897, CVE-2019-0898,     CVE-2019-0899, CVE-2019-0900, CVE-2019-0901,     CVE-2019-0902)

  - An elevation of privilege vulnerability exists when the     Windows Kernel improperly handles key enumeration. An     attacker who successfully exploited the vulnerability     could gain elevated privileges on a targeted system. A     locally authenticated attacker could exploit this     vulnerability by running a specially crafted     application. The security update addresses the     vulnerability by helping to ensure that the Windows     Kernel properly handles key enumeration. (CVE-2019-0881)

  - A remote code execution vulnerability exists in the way     that the Windows Graphics Device Interface (GDI) handles     objects in the memory. An attacker who successfully     exploited this vulnerability could take control of the     affected system. An attacker could then install     programs; view, change, or delete data; or create new     accounts with full user rights.  (CVE-2019-0903)

  - An information disclosure vulnerability exists when     Windows Hyper-V on a host operating system fails to     properly validate input from an authenticated user on a     guest operating system.  (CVE-2019-0886)

  - An elevation of privilege vulnerability exists in the     Unified Write Filter (UWF) feature for Windows 10 when     it improperly restricts access to the registry. An     attacker who successfully exploited the vulnerability     could make changes to the registry keys protected by UWF     without having administrator privileges.
    (CVE-2019-0942)

  - A remote code execution vulnerability exists in the way     that the Chakra scripting engine handles objects in     memory in Microsoft Edge. The vulnerability could     corrupt memory in such a way that an attacker could     execute arbitrary code in the context of the current     user. An attacker who successfully exploited the     vulnerability could gain the same user rights as the     current user.  (CVE-2019-0912, CVE-2019-0913,     CVE-2019-0914, CVE-2019-0915, CVE-2019-0916,     CVE-2019-0917, CVE-2019-0922, CVE-2019-0923,     CVE-2019-0924, CVE-2019-0925, CVE-2019-0927,     CVE-2019-0933)

  - A security feature bypass vulnerability exists in     Windows Defender Application Control (WDAC) which could     allow an attacker to bypass WDAC enforcement. An     attacker who successfully exploited this vulnerability     could circumvent Windows PowerShell Constrained Language     Mode on the machine.  (CVE-2019-0733)

  - An spoofing vulnerability exists when Internet Explorer     improperly handles URLs. An attacker who successfully     exploited this vulnerability could trick a user by     redirecting the user to a specially crafted website. The     specially crafted website could either spoof content or     serve as a pivot to chain an attack with other     vulnerabilities in web services.  (CVE-2019-0921)

  - An elevation of privilege vulnerability exists when the     Diagnostics Hub Standard Collector or the Visual Studio     Standard Collector allows file deletion in arbitrary     locations.  (CVE-2019-0727)

  - An elevation of privilege vulnerability exists in     Microsoft Windows when a man-in-the-middle attacker is     able to successfully decode and replace authentication     request using Kerberos, allowing an attacker to be     validated as an Administrator. The update addresses this     vulnerability by changing how these requests are     validated. (CVE-2019-0734)

  - A remote code execution vulnerability exists when     Microsoft Windows OLE fails to properly validate user     input. An attacker could exploit the vulnerability to     execute malicious code.  (CVE-2019-0885)

  - A remote code execution vulnerability exists in the way     the scripting engine handles objects in memory in     Microsoft browsers. The vulnerability could corrupt     memory in such a way that an attacker could execute     arbitrary code in the context of the current user. An     attacker who successfully exploited the vulnerability     could gain the same user rights as the current user.
    (CVE-2019-0884, CVE-2019-0911, CVE-2019-0918)

  - An elevation of privilege vulnerability exists in the     way Windows Error Reporting (WER) handles files. An     attacker who successfully exploited this vulnerability     could run arbitrary code in kernel mode. An attacker     could then install programs; view, change, or delete     data; or create new accounts with administrator     privileges.  (CVE-2019-0863)

  - An information disclosure vulnerability exists when     Internet Explorer improperly handles objects in memory.
    An attacker who successfully exploited the vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-0930)

  - A denial of service vulnerability exists when .NET     Framework and .NET Core improperly process RegEx     strings. An attacker who successfully exploited this     vulnerability could cause a denial of service against a     .NET application. A remote unauthenticated attacker     could exploit this vulnerability by issuing specially     crafted requests to a .NET Framework (or .NET core)     application. The update addresses the vulnerability by     correcting how .NET Framework and .NET Core applications     handle RegEx string processing. (CVE-2019-0820)

  - An elevation of privilege vulnerability exists in     Microsoft Windows when Windows fails to properly handle     certain symbolic links. An attacker who successfully     exploited this vulnerability could potentially set     certain items to run at a higher level and thereby     elevate permissions.  (CVE-2019-0936)

  - A memory corruption vulnerability exists in the Windows     Server DHCP service when processing specially crafted     packets. An attacker who successfully exploited the     vulnerability could run arbitrary code on the DHCP     server.  (CVE-2019-0725)

  - A denial of service vulnerability exists when .NET     Framework improperly handles objects in heap memory. An     attacker who successfully exploited this vulnerability     could cause a denial of service against a .NET     application.  (CVE-2019-0864)

  - An information disclosure vulnerability exists when the     Windows GDI component improperly discloses the contents     of its memory. An attacker who successfully exploited     the vulnerability could obtain information to further     compromise the users system. There are multiple ways an     attacker could exploit the vulnerability, such as by     convincing a user to open a specially crafted document,     or by convincing a user to visit an untrusted webpage.
    The security update addresses the vulnerability by     correcting how the Windows GDI component handles objects     in memory. (CVE-2019-0758, CVE-2019-0882, CVE-2019-0961)

  - An elevation of privilege vulnerability exists in     Microsoft Edge that could allow an attacker to escape     from the AppContainer sandbox in the browser. An     attacker who successfully exploited this vulnerability     could gain elevated privileges and break out of the Edge     AppContainer sandbox. The vulnerability by itself does     not allow arbitrary code to run. However, this     vulnerability could be used in conjunction with one or     more vulnerabilities (for example a remote code     execution vulnerability and another elevation of     privilege vulnerability) to take advantage of the     elevated privileges when running. The security update     addresses the vulnerability by modifying how Microsoft     Edge handles sandboxing. (CVE-2019-0938)

  - An elevation of privilege vulnerability exists in the     Network Driver Interface Specification (NDIS) when     ndis.sys fails to check the length of a buffer prior to     copying memory to it.  (CVE-2019-0707)

  - A denial of service vulnerability exists when .NET     Framework or .NET Core improperly handle web requests.
    An attacker who successfully exploited this     vulnerability could cause a denial of service against a     .NET Framework or .NET Core web application. The     vulnerability can be exploited remotely, without     authentication. A remote unauthenticated attacker could     exploit this vulnerability by issuing specially crafted     requests to the .NET Framework or .NET Core application.
    The update addresses the vulnerability by correcting how     .NET Framework or .NET Core web applications handles web     requests. (CVE-2019-0980, CVE-2019-0981)

ID	Name	Product	Family	Published	Updated	Severity
144533	Virtuozzo 6 : qemu-guest-agent / qemu-img / qemu-kvm / etc (VZLSA-2019-1181)	Nessus	Virtuozzo Local Security Checks	12/22/2020	2/20/2025	medium
125232	Fedora 28 : kernel / kernel-headers (2019-c36afa818c) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	Fedora Local Security Checks	5/17/2019	2/27/2025	medium
193990	RHEL 7 : qemu-kvm-rhev (RHSA-2019:1200)	Nessus	Red Hat Local Security Checks	4/27/2024	2/19/2025	medium
125092	Amazon Linux AMI : kernel (ALAS-2019-1205) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	Amazon Linux Local Security Checks	5/15/2019	3/6/2025	medium
125176	Debian DSA-4447-1 : intel-microcode - security update (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	Debian Local Security Checks	5/16/2019	3/4/2025	medium
127816	Amazon Linux AMI : qemu-kvm (ALAS-2019-1260) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	Amazon Linux Local Security Checks	8/13/2019	2/24/2025	medium
125058	KB4494440: Windows 10 Version 1607 and Windows Server 2016 May 2019 Security Update (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	Windows : Microsoft Bulletins	5/14/2019	12/5/2022	critical

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

critical