CVE-2019-11091: Medium severity Apple macOS Mojave vulnerability

Published May 2, 2019
·
Updated

Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance05132019.pdf

Other sources

Microcode. Multiple information disclosure issues were addressed partially by updating the microcode and changing the OS scheduler to isolate the system from web content running in the browser. To completely address these issues, there are additional opt-in mitigations to disable hyper threading and enable microcode-based mitigations for all processes by default. Details of the mitigations can be found at https://support.apple.com/kb/HT210107.

Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access.

Additional information: https://access.redhat.com/security/vulnerabilities/mds

Upstream fixes: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fa4bff165070dc40a3de35b78e4f8da8e8d85ec5

Intel Advisory: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00233.html

— Red Hat

Credit

Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco(Intel), Yuval Yarom(University of Adelaide), Brandon Falk(Microsoft Windows Platform Security Team), Giorgi Maisuradze(Microsoft Research), Michael Schwarz, Daniel Gruss(Graz University of Technology), Alyssa Milburn, Sebastian Osterlund, Pietro Frigo, Kaveh Razavi, Herbert Bos, Cristiano Giuffrida(VUSec group at VU Amsterdam), Dan Horea Lutas(BitDefender), Moritz Lipp

Affected Software

11 affected componentsFixes available
Apple macOS Mojave<10.14.5
10.14.5
Apple High Sierra
Apple Sierra
Intel Microarchitectural Data Sampling Uncacheable Memory Firmware
Intel Microarchitectural Data Sampling Uncacheable Memory
Fedoraproject Fedora=29
All of the following
Intel Microarchitectural Data Sampling Uncacheable Memory Firmware
Intel Microarchitectural Data Sampling Uncacheable Memory
debian/intel-microcode
3.20251111.1~deb12u13.20250812.1~deb12u13.20251111.1~deb13u13.20250812.1~deb13u13.20260925.1
debian/linux
6.1.176-16.1.190-16.12.107-16.12.115-27.2.15-17.3.3-1
debian/xen
4.17.5+72-g01140da4e8-14.17.7+13-g2445b30a44-0+deb12u14.20.3+127-gc42374a105-0+deb13u14.20.4+63-g7abfd2bce2-0+deb13u14.20.4+39-gf1e1321c87-14.20.4+63-g7abfd2bce2-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade macOS Mojave to a version that resolves this vulnerability.

    Fixed in 10.14.5
  2. Upgrade

    Upgrade debian/intel-microcode to a version that resolves this vulnerability.

    Fixed in 3.20251111.1~deb12u1Fixed in 3.20250812.1~deb12u1Fixed in 3.20251111.1~deb13u1Fixed in 3.20250812.1~deb13u1Fixed in 3.20260925.1
  3. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.15-1Fixed in 7.3.3-1
  4. Upgrade

    Upgrade debian/xen to a version that resolves this vulnerability.

    Fixed in 4.17.5+72-g01140da4e8-1Fixed in 4.17.7+13-g2445b30a44-0+deb12u1Fixed in 4.20.3+127-gc42374a105-0+deb13u1Fixed in 4.20.4+63-g7abfd2bce2-0+deb13u1Fixed in 4.20.4+39-gf1e1321c87-1Fixed in 4.20.4+63-g7abfd2bce2-1
  5. Configuration

    Disable hyper-threading as an opt-in mitigation for MDSUM.

    CPU Hyper-Threading = disabled
  6. Configuration

    Enable microcode-based mitigations for all processes by default.

    Operating system Microcode-based mitigations = enabled by default for all processes
  7. Compensating control

    Change the OS scheduler to isolate the system from web content running in the browser.

Event History

May 2, 2019
Data Sourced
via Red Hat·12:35 AM
DescriptionSeverityAffected Software
May 14, 2019
CVE Published
via Ubuntu·12:00 AM
Data Sourced
via Ubuntu·12:00 AM
RemedyDescriptionSeverityAffected Software
May 30, 2019
CVE Published
via MITRE·03:28 PM
Data Sourced
via MITRE·03:28 PM
DescriptionWeakness
Data Sourced
via NVD·04:29 PM
DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What is the severity of CVE-2019-11091?

CVE-2019-11091 has been assigned a medium severity level due to its potential for local information disclosure through side channels.

2

How do I fix CVE-2019-11091?

To mitigate CVE-2019-11091, users should apply the relevant security updates and patches provided by their operating system vendors.

3

Which operating systems are affected by CVE-2019-11091?

CVE-2019-11091 affects multiple versions of Apple macOS, Fedora, and may involve Intel microarchitectural data sampling firmware.

4

Is CVE-2019-11091 a hardware vulnerability?

Yes, CVE-2019-11091 is related to a hardware vulnerability that arises from the speculative execution features of some Intel microprocessors.

5

Can an unauthenticated user exploit CVE-2019-11091?

No, exploitation of CVE-2019-11091 requires that the attacker be an authenticated user with local access.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203