CVE-2019-1125

Aliases:UBUNTU-CVE-2019-1125DEBIAN-CVE-2019-1125USN-4096-1
Advisory lineage Upstream: 1 Downstream: 43
Modified
Published: 03 Sept 2019, 17:52
Last modified:04 Aug 2024, 18:06

Vulnerability Summary

Overall Risk (default)
medium
33/100
CVSS Score
5.6 MEDIUM
v3.1 (cve.org)
EPSS Score
4.52% LOW
5% probability -12.03%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

03 Sept 2019, 17:52
Published
Vulnerability first disclosed
04 Aug 2024, 18:06
Last Modified
Vulnerability information updated

Description

An information disclosure vulnerability exists when certain central processing units (CPU) speculatively access memory. An attacker who successfully exploited the vulnerability could read privileged data across trust boundaries. To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The vulnerability would not allow an attacker to elevate user rights directly, but it could be used to obtain information that could be used to try to compromise the affected system further. On January 3, 2018, Microsoft released an advisory and security updates related to a newly-discovered class of hardware vulnerabilities (known as Spectre) involving speculative execution side channels that affect AMD, ARM, and Intel CPUs to varying degrees. This vulnerability, released on August 6, 2019, is a variant of the Spectre Variant 1 speculative execution side channel vulnerability and has been assigned CVE-2019-1125. Microsoft released a security update on July 9, 2019 that addresses the vulnerability through a software change that mitigates how the CPU speculatively accesses memory. Note that this vulnerability does not require a microcode update from your device OEM.

CVSS Metrics

  • v4.0•MEDIUM•Score: 5.7CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
  • v3.1•MEDIUM•Score: 5.6CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N/E:P/RL:O/RC:C
  • v3.1•MEDIUM•Score: 5.6CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
  • v2.0•LOW•Score: 2.1AV:L/AC:L/Au:N/C:P/I:N/A:N

EPSS Trends

Current EPSS score: 4.52%• Percentile: 91%

Affected Systems

  • debian•linux

    < 5.2.7-1 | < 5.2.7-1 | < 5.2.7-1 | < 5.2.7-1

  • ubuntu•linux

    all | < 4.4.0-159.187 | < 4.15.0-58.64

  • ubuntu•linux-aws

    < 4.4.0-1054.58 | < 4.4.0-1090.101 | < 4.15.0-1045.47

  • ubuntu•linux-aws-fips

    < 4.15.0-2018.18 | all

  • ubuntu•linux-aws-hwe

    < 4.15.0-1045.47~16.04.1

  • ubuntu•linux-azure

    < 4.15.0-1059.64~14.04.1 | < 4.15.0-1055.60 | < 5.0.0-1014.14~18.04.1

  • ubuntu•linux-azure-fde

    all

  • ubuntu•linux-azure-fde-5.15

    < 5.15.0-1114.123~20.04.1

  • ubuntu•linux-bluefield

    all

  • ubuntu•linux-fips

    < 4.4.0-1017.22

  • ubuntu•linux-gcp

    < 4.15.0-1040.42~16.04.1 | < 4.15.0-1040.42

  • ubuntu•linux-gcp-fips

    all

  • ubuntu•linux-gke

    all

  • ubuntu•linux-gke-4.15

    < 4.15.0-1040.42

  • ubuntu•linux-gke-5.0

    < 5.0.0-1013.13~18.04.1

  • ubuntu•linux-hwe

    < 4.15.0-58.64~16.04.1 | < 5.0.0-25.26~18.04.1

  • ubuntu•linux-hwe-edge

    all

  • ubuntu•linux-intel-iot-realtime

    all

  • ubuntu•linux-kvm

    < 4.4.0-1054.61 | < 4.15.0-1042.42

  • ubuntu•linux-lts-xenial

    < 4.4.0-164.192~14.04.1

  • ubuntu•linux-oem

    < 4.15.0-1050.57

  • ubuntu•linux-oem-osp1

    < 5.0.0-1018.20

  • ubuntu•linux-oracle

    < 4.15.0-1021.23~16.04.1 | < 4.15.0-1021.23

  • ubuntu•linux-raspi-realtime

    all

  • ubuntu•linux-realtime

    all

  • ubuntu•linux-riscv

    all | all

  • microsoft•windows_10

    na | 1607 | 1703 | 1709 | 1803 | 1809 | 1903

  • microsoft•windows 10 version 1507

    ≥ 10.0.0, < publication

  • microsoft•windows 10 version 1607

    ≥ 10.0.0, < publication

  • microsoft•windows 10 version 1703

    ≥ 10.0.0, < publication

  • microsoft•windows 10 version 1709

    ≥ 10.0.0, < publication

  • microsoft•windows 10 version 1709 for 32-bit systems

    ≥ 10.0.0, < publication

  • microsoft•windows 10 version 1803

    ≥ 10.0.0, < publication

  • microsoft•windows 10 version 1809

    ≥ 10.0.0, < publication

  • microsoft•windows 10 version 1903 for 32-bit systems

    ≥ 10.0.0, < publication

  • microsoft•windows 10 version 1903 for arm64-based systems

    ≥ 10.0.0, < publication

  • microsoft•windows 10 version 1903 for x64-based systems

    ≥ 10.0.0, < publication

  • microsoft•windows_7

    ≥ 6.1.0, < publication | na

  • microsoft•windows 7 service pack 1

    ≥ 6.1.0, < publication

  • microsoft•windows_8.1

    ≥ 6.3.0, < publication | na

  • microsoft•windows_rt_8.1

    na

  • microsoft•windows_server_2008

    na | r2:sp1

  • microsoft•windows server 2008 service pack 2

    ≥ 6.0.0, < publication

  • microsoft•windows server 2008 r2 service pack 1

    ≥ 6.1.0, < publication

  • microsoft•windows server 2008 r2 service pack 1 (server core installation)

    ≥ 6.0.0, < publication

  • microsoft•windows server 2008 r2 systems service pack 1

    ≥ 6.1.0, < publication

  • microsoft•windows server 2008 service pack 2

    ≥ 6.0.0, < publication

  • microsoft•windows server 2008 service pack 2 (server core installation)

    ≥ 6.0.0, < publication

  • microsoft•windows_server_2012

    ≥ 6.2.0, < publication | na | r2

  • microsoft•windows server 2012 r2

    ≥ 6.3.0, < publication

Showing first 50 affected entries in server-rendered view.

References (26)