Kekai Hu

**Name of the Vulnerable Software and Affected Versions** AMD CPUs (affected versions not specified) Existing AMD CPUs vulnerable to the issue AMD CPUs based on Zen+ and Zen 2 microarchitectures **Description** The issue is related to speculative execution of read and write operations, accessing memory using non-canonical addresses. This can potentially result in data leakage. The vulnerability may allow an attacker to disclose information about the kernel's address space using a side-channel attack. The issue is similar to the Meltdown vulnerability. Researchers have demonstrated the effectiveness of the attack, and it is estimated to impact various CPUs, including existing AMD CPUs and future Intel and Arm CPUs. **Recommendations** For existing AMD CPUs, consider disabling speculative execution as a temporary workaround until a patch is available. For AMD CPUs based on Zen+ and Zen 2 microarchitectures, restrict access to sensitive areas of memory to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Intel(R) SGX for 6th, 7th, 8th, 9th Generation Intel(R) Core(TM) Processor Families Intel(R) Xeon(R) Processor E3-1500 v5, v6 Families Intel(R) Xeon(R) E-2100 & E-2200 Processor Families with Intel(R) Processor Graphics **Description** The issue is related to insufficient access control in the protected memory subsystem, which may allow a privileged user to potentially enable information disclosure via local access. This could lead to the exposure of protected information. **Recommendations** For Intel(R) SGX on 6th, 7th, 8th, 9th Generation Intel(R) Core(TM) Processor Families: update the microcode to ensure proper access control. For Intel(R) Xeon(R) Processor E3-1500 v5, v6 Families: apply the recommended configuration changes to restrict local access. For Intel(R) Xeon(R) E-2100 & E-2200 Processor Families with Intel(R) Processor Graphics: restrict access to sensitive information until a proper fix is applied.

**Name of the Vulnerable Software and Affected Versions** Intel microprocessors (affected versions not specified) vCenter Server (affected versions not specified) ESXi (affected versions not specified) Workstation (affected versions not specified) Fusion (affected versions not specified) **Description** The issue is related to Microarchitectural Data Sampling Uncacheable Memory (MDSUM) on some microprocessors that utilize speculative execution. This may allow an authenticated user with local access to potentially enable information disclosure via a side channel. An attacker with local access to a targeted system may exploit this issue to obtain data on the targeted system, causing some information leakage. **Recommendations** For Intel microprocessors, apply the microcode updates as guided by Intel. For vCenter Server, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For ESXi, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For Workstation, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For Fusion, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities.

**Name of the Vulnerable Software and Affected Versions** Intel microprocessors (affected versions not specified) vCenter Server (affected versions not specified) ESXi (affected versions not specified) Workstation (affected versions not specified) Fusion (affected versions not specified) Huawei VRP (affected versions not specified) **Description** The issue is related to Microarchitectural Load Port Data Sampling (MLPDS), which may allow an authenticated user to potentially enable information disclosure via a side channel with local access. This is due to the incorrect implementation of saving outdated operation results in the load port table. The exploitation of this issue can allow an attacker to access confidential information. **Recommendations** For Intel microprocessors, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For vCenter Server, apply Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For ESXi, apply Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For Workstation, apply Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For Fusion, apply Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For Huawei VRP, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Intel Microprocessors (affected versions not specified) vCenter Server (affected versions not specified) ESXi (affected versions not specified) Workstation (affected versions not specified) Fusion (affected versions not specified) **Description** The issue is related to Microarchitectural Fill Buffer Data Sampling (MFBDS), which may allow an authenticated user to potentially enable information disclosure via a side channel with local access. This is due to the speculative execution utilized by some microprocessors. **Recommendations** For Intel Microprocessors, consider applying the microcode updates as guided by Intel to mitigate the risk. For vCenter Server, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For ESXi, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For Workstation, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For Fusion, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities.