{"id":"MGASA-2019-0413","summary":"Updated microcode packages fix security vulnerabilities","details":"NOTE! This is a refresh of the 20191112 security update we released\nas MGASA-2019-0334.\nThis update provides the Intel 20191115 microcode release that adds\nmore microcode side fixes and mitigations for the Core Gen 6 to Core\ngen 10, some Xeon E series, adressing at least the following security\nissues:\n\nA flaw was found in the implementation of SGX around the access control\nof protected memory.  A local attacker of a system with SGX enabled and\nan affected intel GPU with the ability to execute code is able to infer\nthe contents of the SGX protected memory (CVE-2019-0117).\n\nTSX Asynchronous Abort condition on some CPUs utilizing speculative\nexecution may allow an authenticated user to potentially enable information\ndisclosure via a side channel with local access. (CVE-2019-11135).\n\nImproper conditions check in the voltage modulation interface for some\nIntel(R) Xeon(R) Scalable Processors may allow a privileged user to\npotentially enable denial of service via local access (CVE-2019-11139).\n\nImproper invalidation for page table updates by a virtual guest operating\nsystem for multiple Intel(R) Processors may allow an authenticated user to\npotentially enable denial of service of the host system via local access\n(CVE-2018-12207).\n\nTA Indirect Sharing Erratum (Information Leak)\n\nIncomplete fixes for previous MDS mitigations (VERW)\n\nSHUF* instruction implementation flaw (DoS)\n\nEGETKEY Erratum\n\nConditional Jump Macro-fusion (DoS or Privilege Escalation)\n\nFor the software side fixes and mitigations of theese issues, the kernel\nmust be updated to 5.3.13-1.mga7 (mga¤25686) or later.\n","modified":"2026-04-16T00:10:57.704881444Z","published":"2019-12-25T22:57:53Z","upstream":["CVE-2018-12207","CVE-2019-0117","CVE-2019-11135","CVE-2019-11139"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2019-0413.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=25896"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=25686"},{"type":"ADVISORY","url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00164.html"},{"type":"ADVISORY","url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00210.html"},{"type":"ADVISORY","url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00270.html"},{"type":"ADVISORY","url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00271.html"},{"type":"WEB","url":"https://www.intel.com/content/www/us/en/support/articles/000055650/processors/intel-xeon-processors.html"},{"type":"WEB","url":"https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/blob/master/releasenote"}],"affected":[{"package":{"name":"microcode","ecosystem":"Mageia:7","purl":"pkg:rpm/mageia/microcode?arch=source&distro=mageia-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20191115-1.mga7.nonfree"}]}],"ecosystem_specific":{"section":"nonfree"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2019-0413.json"}}],"schema_version":"1.7.5","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}