|Description||Systems with microprocessors utilizing speculative execution and that perform speculative reads of system registers may allow unauthorized disclosure of system parameters to an attacker with local user access via a side-channel analysis, aka Rogue System Register Read (RSRE), Variant 3a.|
|Source||CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)|
|References||DLA-1446-1, DSA-4273-1, DSA-4273-2|
|NVD severity||medium (attack range: local)|
Vulnerable and fixed packages
The table below lists information on source packages.
|stretch/non-free (security), stretch/non-free||3.20190618.1~deb9u1||fixed|
The information below is based on the following data on fixed versions.
No software mitigations planned to be implemented in src:linux
The 3.20180703.1 release for intel-microcode was the first batch of updates which targeted
most server type CPUs, additional models were supported in the 3.20180807a.1 release