CVE-2006-1056
At a glance
- Source
- NVD
- EPSS
- EPSS 0.46 % · percentile 40 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Modified
Description
The Linux kernel before 2.6.16.9 and the FreeBSD kernel, when running on AMD64 and other 7th and 8th generation AuthenticAMD processors, only save/restore the FOP, FIP, and FDP x87 registers in FXSAVE/FXRSTOR when an exception is pending, which allows one process to determine portions of the state of floating point instructions of other processes, which can be leveraged to obtain sensitive information such as cryptographic keys. NOTE: this is the documented behavior of AMD64 processors, but it is inconsistent with Intel processors in a security-relevant fashion that was not addressed by the kernels.
Weaknesses (CWE)
References
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9995
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=187911
- http://www.redhat.com/support/errata/RHSA-2006-0437.html
- http://secunia.com/advisories/22876
- http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.9
- http://secunia.com/advisories/19735
- http://www.vupen.com/english/advisories/2006/4502
- http://www.vupen.com/english/advisories/2006/2554
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=187910
- http://www.redhat.com/support/errata/RHSA-2006-0579.html
- http://secunia.com/advisories/20716
- http://secunia.com/advisories/22875
- http://lwn.net/Alerts/180820/
- http://secunia.com/advisories/21136
- http://www.ubuntu.com/usn/usn-302-1
- http://kb.vmware.com/kb/2533126
- http://www.osvdb.org/24746
- http://www.osvdb.org/24807
- http://secunia.com/advisories/21983
- http://www.vupen.com/english/advisories/2006/4353
- http://secunia.com/advisories/21035
- http://www.vmware.com/download/esx/esx-213-200610-patch.html
- http://www.debian.org/security/2006/dsa-1097
- http://www.redhat.com/support/errata/RHSA-2006-0575.html
- http://www.novell.com/linux/security/advisories/2006-05-31.html
- http://www.securityfocus.com/archive/1/451421/100/0/threaded
- http://www.vupen.com/english/advisories/2006/1426
- http://secunia.com/advisories/19715
- http://securitytracker.com/id?1015966
- http://www.securityfocus.com/archive/1/431341
- http://www.securityfocus.com/bid/17600
- http://support.avaya.com/elmodocs2/security/ASA-2006-180.htm
- http://www.debian.org/security/2006/dsa-1103
- http://www.vmware.com/download/esx/esx-254-200610-patch.html
- http://secunia.com/advisories/21465
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html
- http://marc.info/?l=linux-kernel&m=114548768214478&w=2
- http://www.vupen.com/english/advisories/2006/1475
- http://www.securityfocus.com/archive/1/451404/100/0/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25871
- http://support.avaya.com/elmodocs2/security/ASA-2006-200.htm
- http://secunia.com/advisories/20398
- http://www.securityfocus.com/archive/1/451417/100/200/threaded
- http://security.freebsd.org/advisories/FreeBSD-SA-06:14-amd.txt
- http://secunia.com/advisories/22417
- http://secunia.com/advisories/19724
- http://secunia.com/advisories/20671
- http://www.securityfocus.com/archive/1/451419/100/200/threaded
- http://secunia.com/advisories/20914
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 2.0 | LOW 2.1 | AV:L/AC:L/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2006-1060
- GCVE · GCVE-0-2006-1056
CERT-FR advisories
- CERTA-2006-AVI-501 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≤ 2.6.16.8cpe:2.3:o:linux:linux_kernel:2.6.0:*:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.0:test1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.0:test10:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.0:test11:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.0:test2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.0:test3:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.0:test4:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.0:test5:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.0:test6:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.0:test7:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.0:test8:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.0:test9:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.1:*:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.1:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.1:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.1:rc3:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.2:*:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.2:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.2:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.2:rc3:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.3:*:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.3:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.3:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.3:rc3:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.3:rc4:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.4:*:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.4:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.4:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.4:rc3:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.5:*:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.5:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.5:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.5:rc3:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.6:*:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.6:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.6:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.6:rc3:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:2.6.7:*:*:*:*:*:*:*- +103 more
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |