- Home
- CVEs with nessus.description==An+update+for+kernel+is+now+available+for+Red+Hat+Enterprise+Linux+6.%0A%0ARed+Hat+Product+Security+has+rated+this+update+as+having+a+security+impact+of+Important.+A+Common+Vulnerability+Scoring+System+%28CVSS%29+base+score%2C+which+gives+a+detailed+severity+rating%2C+is+available+for+each+vulnerability+from+the+CVE+link%28s%29+in+the+References+section.%0A%0AThe+kernel+packages+contain+the+Linux+kernel%2C+the+core+of+any+Linux+operating+system.%0A%0ASecurity+Fix%28es%29+%3A%0A%0A%2A+An+industry-wide+issue+was+found+in+the+way+many+modern+microprocessor+designs+have+implemented+speculative+execution+of+Load+%26+Store+instructions+%28a+commonly+used+performance+optimization%29.+It+relies+on+the+presence+of+a+precisely-defined+instruction+sequence+in+the+privileged+code+as+well+as+the+fact+that+memory+read+from+address+to+which+a+recent+memory+write+has+occurred+may+see+an+older+value+and+subsequently+cause+an+update+into+the+microprocessor%27s+data+cache+even+for+speculatively+executed+instructions+that+never+actually+commit+%28retire%29.+As+a+result%2C+an+unprivileged+attacker+could+use+this+flaw+to+read+privileged+memory+by+conducting+targeted+cache+side-channel+attacks.+%28CVE-2018-3639%2C+x86+AMD%29%0A%0A%2A+kernel%3A+Use-after-free+vulnerability+in+mm%2Fmempolicy.c%3Ado_get_mempolicy+function+allows+local+denial+of+service+or+other+unspecified+impact+%28CVE-2018-10675%29%0A%0A%2A+Kernel%3A+FPU+state+information+leakage+via+lazy+FPU+restore+%28CVE-2018-3665%29%0A%0A%2A+kernel%3A+error+in+exception+handling+leads+to+DoS+%28CVE-2018-8897+regression%29+%28CVE-2018-10872%29%0A%0AFor+more+details+about+the+security+issue%28s%29%2C+including+the+impact%2C+a+CVSS+score%2C+and+other+related+information%2C+refer+to+the+CVE+page%28s%29+listed+in+the+References+section.%0A%0ARed+Hat+would+like+to+thank+Ken+Johnson+%28Microsoft+Security+Response+Center%29+and+Jann+Horn+%28Google+Project+Zero%29+for+reporting+CVE-2018-3639+and+Julian+Stecklina+%28Amazon.de%29%2C+Thomas+Prescher+%28cyberus-technology.de%29%2C+and+Zdenek+Sojka+%28sysgo.com%29+for+reporting+CVE-2018-3665.%0A%0ABug+Fix%28es%29+%3A%0A%0A%2A+Previously%2C+microcode+updates+on+32+and+64-bit+AMD+and+Intel+architectures+were+not+synchronized.+As+a+consequence%2C+it+was+not+possible+to+apply+the+microcode+updates.+This+fix+adds+the+synchronization+to+the+microcode+updates+so+that+processors+of+the+stated+architectures+receive+updates+at+the+same+time.+As+a+result%2C+microcode+updates+are+now+synchronized.+%28BZ%23+1574592%29
Max CVSS | 0 |
Min CVSS | 0 |
Total Count | 2 |
| ID | CVSS | Summary | Last (major) update | Published |
Back to Top
Mark selected
Back to Top