Impact: Moderate Public Date: 2019-05-14 CWE: CWE-203->CWE-385 Bugzilla: 1667782: CVE-2018-12127 hardware: Micro-architectural Load Port Data Sampling - Information Leak (MLPDS) Microprocessors use a ‘load port’ subcomponent to perform load operations from memory or IO. During a load operation, the load port receives data from the memory or IO subsystem and then provides the data to the CPU registers and operations in the CPU’s pipelines. Stale load operations results are stored in the 'load port' table until overwritten by newer operations. Certain load-port operations triggered by an attacker can be used to reveal data about previous stale requests leaking data back to the attacker via a timing side-channel.
Find out more about CVE-2018-12127 from the MITRE CVE dictionary dictionary and NIST NVD.
Red Hat Product Security is aware of this issue. Updates will be released as they become available. For additional information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/security/vulnerabilities/mds
NOTE: The following CVSS v3 metrics and score provided are preliminary and subject to review.
| CVSS3 Base Score | 6.5 |
|---|---|
| CVSS3 Base Metrics | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
| Attack Vector | Local |
| Attack Complexity | Low |
| Privileges Required | Low |
| User Interaction | None |
| Scope | Changed |
| Confidentiality | High |
| Integrity Impact | None |
| Availability Impact | None |
| Platform | Errata | Release Date |
|---|---|---|
| Red Hat Enterprise Linux 8 (kernel) | RHSA-2019:1167 | 2019-05-14 |
| Red Hat Enterprise Linux 8 (kernel-rt) | RHSA-2019:1174 | 2019-05-14 |
| Red Hat Enterprise Linux Extended Update Support 7.5 (libvirt) | RHSA-2019:1182 | 2019-05-14 |
| Red Hat Enterprise Linux 8 (kernel) | RHSA-2019:1167 | 2019-05-14 |
| Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts (qemu-kvm-rhev) | RHSA-2019:1179 | 2019-05-14 |
| Red Hat Enterprise Linux 7 (qemu-kvm) | RHSA-2019:1178 | 2019-05-14 |
| Red Hat Enterprise Linux Extended Update Support 7.4 (kernel) | RHSA-2019:1170 | 2019-05-14 |
| Red Hat Enterprise Linux 7 (libvirt) | RHSA-2019:1177 | 2019-05-14 |
| Red Hat Enterprise Linux 8 (kernel-rt) | RHSA-2019:1174 | 2019-05-14 |
| Red Hat Enterprise Linux Extended Update Support 7.4 (libvirt) | RHSA-2019:1184 | 2019-05-14 |
| Red Hat Enterprise Linux Extended Update Support 7.4 (qemu-kvm) | RHSA-2019:1185 | 2019-05-14 |
| Red Hat Enterprise Linux for Real Time for NFV (v. 7) (kernel-rt) | RHSA-2019:1176 | 2019-05-14 |
| Red Hat Enterprise Linux 7 (kernel) | RHSA-2019:1168 | 2019-05-14 |
| Red Hat Enterprise Linux 6 (libvirt) | RHSA-2019:1180 | 2019-05-14 |
| Red Hat Enterprise Linux 6 (qemu-kvm) | RHSA-2019:1181 | 2019-05-14 |
| Red Hat Enterprise Linux Extended Update Support 7.5 (kernel) | RHSA-2019:1155 | 2019-05-14 |
| Red Hat Enterprise Linux 8 (virt:rhel) | RHSA-2019:1175 | 2019-05-14 |
| Red Hat Enterprise Linux Extended Update Support 7.5 (qemu-kvm) | RHSA-2019:1183 | 2019-05-14 |
| Red Hat Enterprise Linux 6 (kernel) | RHSA-2019:1169 | 2019-05-14 |
| Platform | Package | State |
|---|---|---|
| Red Hat Virtualization 4 | vdsm | Affected |
| Red Hat Virtualization 4 | ovirt-guest-agent | Affected |
| Red Hat Virtualization 4 | rhvm-appliance | Affected |
| Red Hat Virtualization 4 | rhvm-setup-plugins | Affected |
| Red Hat Virtualization 4 | redhat-virtualization-host | Affected |
| Red Hat OpenStack Platform 9.0 | qemu-kvm-rhev | Affected |
| Red Hat OpenStack Platform 14.0 (Rocky) | qemu-kvm-rhev | Affected |
| Red Hat OpenStack Platform 13.0 (Queens) | qemu-kvm-rhev | Affected |
| Red Hat OpenStack Platform 10 | qemu-kvm-rhev | Affected |
| Red Hat Enterprise MRG 2 | kernel-rt | Affected |
| Red Hat Enterprise Linux 8 Advanced Virtualization | virt:8.0.0/libvirt | Affected |
| Red Hat Enterprise Linux 8 Advanced Virtualization | virt:8.0.0/qemu-kvm | Affected |
| Red Hat Enterprise Linux 7 | kernel-alt | Not affected |
| Red Hat Enterprise Linux 5 | kernel | Will not fix |
Vulmon