Security Notice – Statement on Intel Processors Data Leakage Advisory (INTEL-SA-00329)

On January 27, 2020, intel released a security update that disclosed two security vulnerabilities of Intel processors that could lead to information disclosure. CVE numbers are CVE-2020-0548 and CVE-2020-0549. Intel will be providing fixes in future microcode updates. The vulnerability details are as follows:
CVE-2020-0549：L1D Eviction Sampling
On some processors under certain microarchitectural conditions, data from the most recently evicted modified L1 data cache (L1D) line may be propagated into an unused (invalid) L1D fill buffer. On processors affected by Microarchitectural Data Samping (MDS) or Transactional Asynchronous Abort (TAA), data from an L1D fill buffer may be inferred using one of these data sampling side channel methods. By combining these two behaviors together, it may be possible for a malicious actor to infer data values from modified cache lines that were previously evicted from the L1 data cache. This is called L1D eviction sampling.
CVE-2020-0548
Cleanup errors in some data cache evictions for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. This vulnerability has been assigned CVE-2020-0549 with a CVSS of 2.8.
Inspur provides product vulnerability solutions through Security Advisory (SA).Inspur has issued Security Advisory (SA) for these vulnerabilities.

Impacted Products