CVE-2019-11135 – TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access.
The flaw affecting the Processor Diagnostic Tool is tracked as ZombieLoad Variant 2, tracked as CVE-2019-11135, is related to Intel’s Transactional Synchronization Extensions (TSX), which is designed to improve performance for multi-threaded software. ZombieLoad Variant 2, which Intel has described as a Transactional Asynchronous Abort (TAA) vulnerability, affects all CPUs that support TSX and have the TAA_NO bit set to 0. ZombieLoad Variant 2 also works against Intel Xeon Gold server processors with Cascade Lake microarchitecture and Core i9 processors with Coffee Lake microarchitecture. An attacker who has access to a system running the tool can exploit the vulnerability to escalate privileges, obtain information, or cause a denial-of-service (DoS) condition.