usn-4182-2
Vulnerability from osv_ubuntu
Published
2019-11-12 22:04
Modified
2026-06-03 10:45
Summary
intel-microcode update
Details

USN-4182-2 provided updates for Intel Microcode. This update provides the corresponding update for Ubuntu 14.04 ESM.

Stephan van Schaik, Alyssa Milburn, Sebastian Österlund, Pietro Frigo, Kaveh Razavi, Herbert Bos, Cristiano Giuffrida, Giorgi Maisuradze, Moritz Lipp, Michael Schwarz, Daniel Gruss, and Jo Van Bulck discovered that Intel processors using Transactional Synchronization Extensions (TSX) could expose memory contents previously stored in microarchitectural buffers to a malicious process that is executing on the same CPU core. A local attacker could use this to expose sensitive information. (CVE-2019-11135)

It was discovered that certain Intel Xeon processors did not properly restrict access to a voltage modulation interface. A local privileged attacker could use this to cause a denial of service (system crash). (CVE-2019-11139)

References
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2019-11135",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "high",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2019-11139",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "intel-microcode",
            "binary_version": "3.20191112-0ubuntu0.14.04.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "intel-microcode",
        "purl": "pkg:deb/ubuntu/intel-microcode@3.20191112-0ubuntu0.14.04.2?arch=source\u0026distro=trusty/esm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.20191112-0ubuntu0.14.04.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.20130906.1ubuntu2",
        "1.20130906.1ubuntu3",
        "2.20140122.1",
        "2.20140430.1ubuntu1",
        "2.20140624-t-1ubuntu2",
        "3.20180108.0~ubuntu14.04.2",
        "3.20180108.0+really20170707ubuntu14.04.1",
        "3.20180312.0~ubuntu14.04.1",
        "3.20180425.1~ubuntu0.14.04.1",
        "3.20180425.1~ubuntu0.14.04.2",
        "3.20180807a.0ubuntu0.14.04.1",
        "3.20190514.0ubuntu0.14.04.1",
        "3.20190514.0ubuntu0.14.04.2",
        "3.20190618.0ubuntu0.14.04.1"
      ]
    }
  ],
  "aliases": [],
  "details": "USN-4182-2 provided updates for Intel Microcode. This update provides\nthe corresponding update for Ubuntu 14.04 ESM.\n\nStephan van Schaik, Alyssa Milburn, Sebastian \u00d6sterlund, Pietro Frigo,\nKaveh Razavi, Herbert Bos, Cristiano Giuffrida, Giorgi Maisuradze, Moritz\nLipp, Michael Schwarz, Daniel Gruss, and Jo Van Bulck discovered that Intel\nprocessors using Transactional Synchronization Extensions (TSX) could\nexpose memory contents previously stored in microarchitectural buffers to a\nmalicious process that is executing on the same CPU core. A local attacker\ncould use this to expose sensitive information. (CVE-2019-11135)\n\nIt was discovered that certain Intel Xeon processors did not properly\nrestrict access to a voltage modulation interface. A local privileged\nattacker could use this to cause a denial of service (system crash).\n(CVE-2019-11139)\n",
  "id": "USN-4182-2",
  "modified": "2026-06-03T10:45:19Z",
  "published": "2019-11-12T22:04:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-4182-2"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2019-11135"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2019-11139"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "intel-microcode update",
  "upstream": [
    "UBUNTU-CVE-2019-11135",
    "UBUNTU-CVE-2019-11139"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.