| Name | CVE-2018-12130 |
| Description | Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more) |
| References | DLA-1787-1, DLA-1789-1, DLA-1789-2, DLA-1799-1, DSA-4444-1, DSA-4447-1 |
| NVD severity | medium |
| Debian Bugs | 929129 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| intel-microcode (PTS) | stretch/non-free | 3.20200616.1~deb9u1 | fixed |
| stretch/non-free (security) | 3.20210608.2~deb9u2 | fixed | |
| buster/non-free | 3.20220207.1~deb10u1 | fixed | |
| buster/non-free (security) | 3.20210608.2~deb10u1 | fixed | |
| bullseye/non-free | 3.20220207.1~deb11u1 | fixed | |
| bookworm/non-free, sid/non-free | 3.20220207.1 | fixed | |
| linux (PTS) | stretch | 4.9.228-1 | fixed |
| stretch (security) | 4.9.303-1 | fixed | |
| buster | 4.19.235-1 | fixed | |
| buster (security) | 4.19.232-1 | fixed | |
| bullseye | 5.10.106-1 | fixed | |
| bullseye (security) | 5.10.103-1 | fixed | |
| bookworm, sid | 5.16.18-1 | fixed | |
| xen (PTS) | stretch (security), stretch | 4.8.5.final+shim4.10.4-1+deb9u12 | fixed |
| buster, buster (security) | 4.11.4+107-gef32c7afa2-1 | fixed | |
| bullseye | 4.14.3+32-g9de3671772-1~deb11u1 | fixed | |
| bullseye (security) | 4.14.4+74-gd7b22226b5-1 | fixed | |
| bookworm | 4.14.3+32-g9de3671772-1 | fixed | |
| sid | 4.16.0+51-g0941d6cb-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| intel-microcode | source | jessie | 3.20190618.1~deb8u1 | DLA-1789-2 | ||
| intel-microcode | source | stretch | 3.20190514.1~deb9u1 | DSA-4447-1 | ||
| intel-microcode | source | (unstable) | 3.20190514.1 | |||
| linux | source | jessie | 3.16.68-1 | DLA-1799-1 | ||
| linux | source | stretch | 4.9.168-1+deb9u2 | DSA-4444-1 | ||
| linux | source | (unstable) | 4.19.37-2 | |||
| linux-4.9 | source | jessie | 4.9.168-1+deb9u2~deb8u1 | DLA-1787-1 | ||
| xen | source | stretch | 4.8.5.final+shim4.10.4-1+deb9u12 | |||
| xen | source | (unstable) | 4.11.1+92-g6c33308a8d-1 | 929129 |
[jessie] - xen <ignored> (Depends on fix for CVE-2017-5715, CVE-2017-5753, CVE-2017-5754)
https://git.kernel.org/linus/fa4bff165070dc40a3de35b78e4f8da8e8d85ec5
https://software.intel.com/security-software-guidance/software-guidance/microarchitectural-data-sampling
https://xenbits.xen.org/xsa/advisory-297.html
libvirt support for md-clear CPUID bit:
https://libvirt.org/git/?p=libvirt.git;a=commit;h=538d873571d7a682852dc1d70e5f4478f4d64e85
qemu and libvirt need updates to passthrough md-clear, see #929067 for qemu and #929154 for libvirt