CVE-2019-11091: Medium severity Apple macOS Mojave vulnerability
Last updated 25 September 2025
Other sources
Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance05132019.pdf
— Launchpad
Microcode. Multiple information disclosure issues were addressed partially by updating the microcode and changing the OS scheduler to isolate the system from web content running in the browser. To completely address these issues, there are additional opt-in mitigations to disable hyper threading and enable microcode-based mitigations for all processes by default. Details of the mitigations can be found at https://support.apple.com/kb/HT210107.
Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access.
Additional information: https://access.redhat.com/security/vulnerabilities/mds
Upstream fixes: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fa4bff165070dc40a3de35b78e4f8da8e8d85ec5
Intel Advisory: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00233.html
— Red Hat
Credit
Affected Software
Remediation
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2019-8603
- CVE-2019-8635
- CVE-2019-8590
- CVE-2019-8640
- CVE-2019-2102
- CVE-2019-8592
- CVE-2019-8585
- CVE-2019-8582
- CVE-2019-8589
- CVE-2019-8560
- CVE-2019-8634
- CVE-2019-8616
- CVE-2019-8629
- CVE-2018-4456
- CVE-2019-8606
- CVE-2019-8633
- CVE-2019-8525
- CVE-2019-8547
- CVE-2019-8576
- CVE-2019-8591
- CVE-2019-8573
- CVE-2019-8631
- CVE-2018-12126
- CVE-2018-12127
- CVE-2018-12130
- CVE-2019-11091
- CVE-2019-8604
- CVE-2019-8577
- CVE-2019-8600
- CVE-2019-8598
- CVE-2019-8602
- CVE-2019-8568
- CVE-2019-8574
- CVE-2019-8569
- CVE-2019-6237
- CVE-2019-8571
- CVE-2019-8583
- CVE-2019-8584
- CVE-2019-8586
- CVE-2019-8587
- CVE-2019-8594
- CVE-2019-8595
- CVE-2019-8596
- CVE-2019-8597
- CVE-2019-8601
- CVE-2019-8608
- CVE-2019-8609
- CVE-2019-8610
- CVE-2019-8611
- CVE-2019-8615
- CVE-2019-8619
- CVE-2019-8622
- CVE-2019-8623
- CVE-2019-8628
- CVE-2019-8607
- CVE-2019-8612
Frequently Asked Questions
What is the severity of CVE-2019-11091?
CVE-2019-11091 has been assigned a medium severity level due to its potential for local information disclosure through side channels.
How do I fix CVE-2019-11091?
To mitigate CVE-2019-11091, users should apply the relevant security updates and patches provided by their operating system vendors.
Which operating systems are affected by CVE-2019-11091?
CVE-2019-11091 affects multiple versions of Apple macOS, Fedora, and may involve Intel microarchitectural data sampling firmware.
Is CVE-2019-11091 a hardware vulnerability?
Yes, CVE-2019-11091 is related to a hardware vulnerability that arises from the speculative execution features of some Intel microprocessors.
Can an unauthenticated user exploit CVE-2019-11091?
No, exploitation of CVE-2019-11091 requires that the attacker be an authenticated user with local access.