Ubuntu updates to mitigate latest Intel hardware vulnerabilities

Alex Murray

on 12 November 2019

Tags: Intel , Security

This article is more than 5 years old.


Today, Intel announced a group of new vulnerabilities affecting various Intel CPUs and associated GPUs, known as TSX Asynchronous Abort (CVE-2019-11135), Intel® Processor Machine Check Error (CVE-2018-12207), and two Intel i915 graphics hardware  vulnerabilities (CVE-2019-0155, CVE-2019-0154).

TSX Asynchronous Abort (TAA) is related to the previously announced MDS vulnerabilities but only affects Intel processors that support Intel® Transactional Synchronization Extensions (TSX). Due to the similarity between this issue and MDS, the mitigations for MDS are sufficient to also mitigate TAA. As such, processors which were previously affected by MDS and which have the MDS microarchitectural buffer clearing mitigations employed are not affected by TAA. For newer processors which were not affected by MDS, but which support Intel® TSX, TAA is mitigated in Ubuntu by a combination of an updated Linux kernel and Intel microcode packages which disable Intel® TSX. Where TSX is required, this can be re-enabled via a kernel command-line option (tsx=on) and in this case, the kernel will automatically employ microarchitectural buffer clearing mechanisms as used for MDS to mitigate TAA.

Intel® Processor Machine Check Error (MCEPSC, also called iTLB multihit) is a vulnerability specific to virtualisation, where a virtual machine can cause a denial of service (system hang) to the host processor when hugepages are employed. This is mitigated in Ubuntu with an updated Linux kernel.

The first of the two Intel i915 graphics processor vulnerabilities (CVE-2019-0155) allow an unprivileged user to elevate their privileges on the system and expose sensitive information from the kernel. The second vulnerability (CVE-2019-0154) allows an unprivileged user to cause a denial of service (system hang) by reading from particular memory regions when in certain low power states.  Mitigations for these two issues in Ubuntu are provided through a combination of firmware and kernel driver updates for these GPUs.

For further details, including the specific package versions which mitigate these vulnerabilities for each Ubuntu release, please consult this article within the Ubuntu Security Knowledge Base.

Talk to us today

Interested in running Ubuntu in your organisation?

Newsletter signup

Get the latest Ubuntu news and updates in your inbox.

By submitting this form, I confirm that I have read and agree to Canonical’s Privacy Policy.

Related posts

A CISO’s guide to Application Security best practices 

Effective AppSec is not a one-time fix but a continuous journey across every facet of your application’s lifecycle. By embracing a Secure Software Development...

ROS Noetic is EOL – take action to maintain fleet security

As of May 2025, the Robot Operating System (ROS) Noetic Ninjemys officially reached its end of life (EOL). First released in 2020 as the final ROS (1)...

Is Linux secure?

Does operating system (OS) security matter? Meet Pal. Pal is a senior developer working at PalBank. For the next 6 months, Pal will be responsible for leading...