SecurityWeek reports that software updates have been unveiled by numerous software vendors to remediate the new speculative execution attack dubbed "Retbleed" aimed at return trampolines implemented for Spectre side-channel attack mitigation.
Both Intel and AMD, which were discovered to have processors impacted by Retbleed," have issued their respective patches, while Citrix has introduced hotfixes for Hypervisor systems running on AMD Zen 1 or Zen 2. On the other hand, VMware has noted that fixes have been available in ESXi versions 6.5, 6.7, and 7.0, as well as Cloud Foundation versions 3.x and 4.x.
"A malicious actor with administrative access to a virtual machine can take advantage of various side-channel CPU flaws that may leak information stored in physical memory about the hypervisor or other virtual machines that reside on the same ESXi host," said VMware.
Microsoft and Fedora also released updates to protect systems against the speculative attack. Meanwhile, Ubuntu and Red Hat are still working on their patches.
Included in the exposed dataset labeled "PDL" were individuals' full names, email addresses, phone numbers, location data, professional summaries, and skills, as well as education and employment histories.
Attackers could leverage the issue — which impacts Nexus 3000, 7000, and 9000 series switches with vulnerable NX-OS versions with DHCPv6 activated and are in standalone NX-OS mode — to facilitate continuous crashes of the dhcp_snoop process and a denial-of-service condition.
Higher rewards of up to $250,000 will be given by Google for the discovery of memory corruption flaws in the Chrome browser shown to achieve remote code execution using a non-sandboxed process as part of a more robust vulnerability reward program.