CVE-2019-11135
Vulnerability Summary
Timeline
Description
TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access.
CVSS Metrics
- v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- v2.0•LOW•Score: 2.1AV:L/AC:L/Au:N/C:P/I:N/A:N
EPSS Trends
Current EPSS score: 3.13%• Percentile: 87%
Affected Systems
- alpine•intel-ucode
< 20191113-r0 | < 20191113-r0 | < 20191113-r0 | < 20191113-r0 | < 20191113-r0 | < 20191113-r0 | < 20191113-r0 | < 20191113-r0 | < 20191113-r0 | < 20191113-r0 | < 20191113-r0 | < 20191113-r0
- alpine•xen
< 4.12.1-r1 | < 4.13.0-r0 | < 4.13.0-r0 | < 4.13.0-r0 | < 4.13.0-r0 | < 4.13.0-r0 | < 4.13.0-r0 | < 4.13.0-r0 | < 4.13.0-r0 | < 4.13.0-r0 | < 4.13.0-r0 | < 4.13.0-r0 | < 4.13.0-r0 | < 4.13.0-r0 | < 4.13.0-r0 | < 4.10.4-r1 | < 4.11.2-r1
- canonical•ubuntu_linux
14.04
- debian•intel-microcode
< 3.20191112.1 | < 3.20191112.1 | < 3.20191112.1 | < 3.20191112.1
- debian•linux
< 5.3.9-2 | < 5.3.9-2 | < 5.3.9-2 | < 5.3.9-2
- debian•xen
< 4.11.3+24-g14b62ab3e5-1 | < 4.11.3+24-g14b62ab3e5-1 | < 4.11.3+24-g14b62ab3e5-1 | < 4.11.3+24-g14b62ab3e5-1
- ubuntu•intel-microcode
< 3.20191112-0ubuntu0.14.04.2 | < 3.20191112-0ubuntu0.16.04.2 | < 3.20191112-0ubuntu0.18.04.2 | < 3.20191115.1ubuntu1
- ubuntu•linux
< 3.13.0-175.226 | < 4.4.0-168.197 | < 4.15.0-69.78
- ubuntu•linux-aws
< 4.4.0-1058.62 | < 4.4.0-1098.109 | < 4.15.0-1054.56
- ubuntu•linux-aws-fips
< 4.15.0-2018.18 | all
- ubuntu•linux-aws-hwe
< 4.15.0-1054.56~16.04.1
- ubuntu•linux-azure
< 4.15.0-1063.68~14.04.1 | < 4.15.0-1063.68 | < 5.0.0-1025.27~18.04.1
- ubuntu•linux-azure-edge
all
- ubuntu•linux-azure-fde
all
- ubuntu•linux-azure-fde-5.15
< 5.15.0-1114.123~20.04.1
- ubuntu•linux-azure-fips
< 4.15.0-2006.7 | all
- ubuntu•linux-bluefield
all
- ubuntu•linux-fips
< 4.4.0-1025.30 | all
- ubuntu•linux-gcp
< 4.15.0-1049.52 | < 5.0.0-1025.26~18.04.1
- ubuntu•linux-gcp-edge
all
- ubuntu•linux-gcp-fips
all
- ubuntu•linux-gke
all
- ubuntu•linux-gke-4.15
< 4.15.0-1048.51
- ubuntu•linux-gke-5.0
< 5.0.0-1025.26~18.04.1
- ubuntu•linux-hwe
< 4.15.0-69.78~16.04.1 | < 5.0.0-35.38~18.04.1
- ubuntu•linux-hwe-edge
all | all
- ubuntu•linux-intel-iot-realtime
all
- ubuntu•linux-kvm
< 4.4.0-1062.69 | < 4.15.0-1050.50
- ubuntu•linux-lts-xenial
< 4.4.0-168.197~14.04.1
- ubuntu•linux-oem
< 4.15.0-1063.72
- ubuntu•linux-oem-osp1
< 5.0.0-1027.31
- ubuntu•linux-oracle
< 4.15.0-1029.32~16.04.1 | < 4.15.0-1029.32
- ubuntu•linux-raspi-realtime
all
- ubuntu•linux-raspi2
< 4.4.0-1126.135 | < 4.15.0-1052.56 | all
- ubuntu•linux-realtime
all
- ubuntu•linux-riscv
all | all
- ubuntu•linux-snapdragon
< 4.4.0-1130.138 | < 4.15.0-1069.76
- debian•debian_linux
8.0 | 9.0 | 10.0
- fedoraproject•fedora
30 | 31
- hp•apollo_2000_firmware
< 2.20
- hp•apollo_4200_firmware
< 2.20
- hp•proliant_bl460c_firmware
< 2.20
- hp•proliant_dl120_firmware
< 2.20
- hp•proliant_dl160_firmware
< 2.20
- hp•proliant_dl180_firmware
< 2.20
- hp•proliant_dl20_firmware
< 2.10
- hp•proliant_dl360_firmware
< 2.20
- hp•proliant_dl380_firmware
< 2.20
- hp•proliant_dl560_firmware
< 2.20
- hp•proliant_dl580_firmware
< 2.20
Showing first 50 affected entries in server-rendered view.
References (46)
- https://seclists.org/bugtraq/2019/Nov/26
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00046.html
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00045.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5WWPW4BSZDDW7VHU427XTVXV7ROOFFW/
- https://access.redhat.com/errata/RHSA-2019:3936
- https://usn.ubuntu.com/4186-2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IZYATWNUGHRBG6I3TC24YHP5Y3J7I6KH/
- http://www.openwall.com/lists/oss-security/2019/12/10/3
- http://www.openwall.com/lists/oss-security/2019/12/10/4
- http://www.openwall.com/lists/oss-security/2019/12/11/1
- https://seclists.org/bugtraq/2019/Dec/28
- https://lists.debian.org/debian-lts-announce/2019/12/msg00035.html
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00042.html
- https://access.redhat.com/errata/RHSA-2020:0026
- https://access.redhat.com/errata/RHSA-2020:0028
- https://www.debian.org/security/2020/dsa-4602
- https://seclists.org/bugtraq/2020/Jan/21
- https://access.redhat.com/errata/RHSA-2020:0204
- https://access.redhat.com/errata/RHSA-2020:0279
- https://access.redhat.com/errata/RHSA-2020:0366
- https://access.redhat.com/errata/RHSA-2020:0555
- https://access.redhat.com/errata/RHSA-2020:0666
- https://access.redhat.com/errata/RHSA-2020:0730
- https://security.gentoo.org/glsa/202003-56
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00270.html
- https://support.f5.com/csp/article/K02912734?utm_source=f5support&%3Butm_medium=RSS
- http://packetstormsecurity.com/files/155375/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03968en_us
- https://kc.mcafee.com/corporate/index?page=content&id=SB10306
- https://security.alpinelinux.org/vuln/CVE-2019-11135
- https://ubuntu.com/security/CVE-2019-11135
- https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/TAA_MCEPSC_i915
- https://software.intel.com/security-software-guidance/insights/deep-dive-intel-transactional-synchronization-extensions-intel-tsx-asynchronous-abort
- https://ubuntu.com/security/notices/USN-4182-1
- https://ubuntu.com/security/notices/USN-4182-2
- https://ubuntu.com/security/notices/USN-4183-1
- https://ubuntu.com/security/notices/USN-4184-1
- https://ubuntu.com/security/notices/USN-4185-1
- https://ubuntu.com/security/notices/USN-4185-2
- https://ubuntu.com/security/notices/USN-4186-1
- https://ubuntu.com/security/notices/USN-4186-2
- https://ubuntu.com/security/notices/USN-4187-1
- https://ubuntu.com/security/notices/USN-4188-1
- https://www.cve.org/CVERecord?id=CVE-2019-11135
- https://security-tracker.debian.org/tracker/CVE-2019-11135