var-202106-0344
Vulnerability from variot

Observable timing discrepancy in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

For the stable distribution (buster), these problems have been fixed in version 3.20210608.2~deb10u1.

Note that there are two reported regressions; for some CoffeeLake CPUs this update may break iwlwifi (https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/issues/56) and some for Skylake R0/D0 CPUs on systems using a very outdated firmware/BIOS, the system may hang on boot: (https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/issues/31)

If you are affected by those issues, you can recover by disabling microcode loading on boot (as documented in README.Debian (also available online at https://salsa.debian.org/hmh/intel-microcode/-/blob/master/debian/README.Debian))

We recommend that you upgrade your intel-microcode packages.

For the detailed security status of intel-microcode please refer to its security tracker page at: https://security-tracker.debian.org/tracker/intel-microcode

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmDXan0ACgkQEMKTtsN8 Tja9aQ//f1dHsEghQsedGnkMCIa2qLi12UFtb4yW7TYV6uwloqbYZMbymvoXYOAB haasn+yCaGUkXuAHxcGvZuN41EkRhdG4LfS5qoZxPMsw84ETjpV2Ohwhuqwf9P20 9pqV1QLjVPCMiCqvHatkzyRNPtRhIh0uCRx5HtIeOEyKTwhVnUJrrljUXCzMDviD 3As0n0yVUPDIcJdaVxp5mxyebf1NyIYMR+7wmzTBOhK6i+rEE4NkKGkcsYBIM1ch AdTQNHv78QZld6ixL8iCUe1NsSugZ2QjbVL1BLW45fJv3f0BIF5uo6LBzbiJlN/6 xWwOdFTfqW1ORyr0k6JQ+yKz3oSE+jfUStwf+zegWOjYes5gGaA/nATzzNwwFfCQ qDqMmnN26qMI3MswP50ESkNs2JTK3955cIJjnscp5DeFArDuCFKh9wcqSZ46/QCE GVRi+F/Dh3JQxv/jP8jfLhCvkBptuendGo9qK5v22QoeCRoHS16dLu7HHP34hRrw k//EgtP35pD9eTNiIsxhmx3qTPD0gbQbcMG/5NTVtpNqsffAxYtqTy8+/4lfPkNn AYtYrrG6tjEHe1gasLkjthB7c0YLzPLdNyZkNIk6XZ2YIhx18N80c7gTBERSJ1Sh 9lmsnX3+5GWM7Fx2NN2vL5xIEo0einMJCyTlNMRDLim2ix1vpZg= =RVf2 -----END PGP SIGNATURE----- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

====================================================================
Red Hat Security Advisory

Synopsis: Important: microcode_ctl security, bug fix and enhancement update Advisory ID: RHSA-2021:2305-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:2305 Issue date: 2021-06-08 CVE Names: CVE-2020-24489 CVE-2020-24511 CVE-2020-24512 CVE-2020-24513 ==================================================================== 1. Summary:

An update for microcode_ctl is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  1. Relevant releases/architectures:

Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64

  1. Description:

The microcode_ctl packages provide microcode updates for Intel.

Security Fix(es):

  • hw: vt-d related privilege escalation (CVE-2020-24489)

  • hw: improper isolation of shared resources in some Intel Processors (CVE-2020-24511)

  • hw: observable timing discrepancy in some Intel Processors (CVE-2020-24512)

  • hw: information disclosure on some Intel Atom processors (CVE-2020-24513)

Bug Fix(es) and Enhancement(s):

  • Update Intel CPU microcode to microcode-20210525 release

  • Solution:

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

  1. Bugs fixed (https://bugzilla.redhat.com/):

1962650 - CVE-2020-24489 hw: vt-d related privilege escalation 1962666 - CVE-2020-24513 hw: information disclosure on some Intel Atom processors 1962702 - CVE-2020-24511 hw: improper isolation of shared resources in some Intel Processors 1962722 - CVE-2020-24512 hw: observable timing discrepancy in some Intel Processors

  1. Package List:

Red Hat Enterprise Linux Client (v. 7):

Source: microcode_ctl-2.1-73.9.el7_9.src.rpm

x86_64: microcode_ctl-2.1-73.9.el7_9.x86_64.rpm microcode_ctl-debuginfo-2.1-73.9.el7_9.x86_64.rpm

Red Hat Enterprise Linux ComputeNode (v. 7):

Source: microcode_ctl-2.1-73.9.el7_9.src.rpm

x86_64: microcode_ctl-2.1-73.9.el7_9.x86_64.rpm microcode_ctl-debuginfo-2.1-73.9.el7_9.x86_64.rpm

Red Hat Enterprise Linux Server (v. 7):

Source: microcode_ctl-2.1-73.9.el7_9.src.rpm

x86_64: microcode_ctl-2.1-73.9.el7_9.x86_64.rpm microcode_ctl-debuginfo-2.1-73.9.el7_9.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 7):

Source: microcode_ctl-2.1-73.9.el7_9.src.rpm

x86_64: microcode_ctl-2.1-73.9.el7_9.x86_64.rpm microcode_ctl-debuginfo-2.1-73.9.el7_9.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

  1. References:

https://access.redhat.com/security/cve/CVE-2020-24489 https://access.redhat.com/security/cve/CVE-2020-24511 https://access.redhat.com/security/cve/CVE-2020-24512 https://access.redhat.com/security/cve/CVE-2020-24513 https://access.redhat.com/security/updates/classification/#important

  1. Contact:

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1

iQIVAwUBYMAkjNzjgjWX9erEAQj9Rw//aAXwJWN2Q/e3KJ6n+bdhBXSWxMI+ro7r 86Elrmw3BY2uTNbkjEorxQfON15ZawMJn0eNprNGA4gxRJ1/OlV+bMXcXsHcxdwt 2ndTxSL9G3xd+B3j6L8N2YQAXzCSzJT2ohbFPntZeMDpd6hILbNO+XDmnPu0uEsh E1Rl1BNsQJGoJ9yrrk9hqae2erlB2nTuDwYcNN6YWANkpWxPnzrJBRt115hBL/Xm Gh9vsxTC98/V+TWn0o0gLDUr0sM21KhD2U8F3byxBQB4Kr4Y0X34U12whwHkG95b m+HKj38OHmwhm+JZV68AsVBbnaa4TM3ilccuAVujxcW10IyXZBsmBFoEnIQ5Y7mm X8Bc5goFlKet/cDqwwUDBvjFfXfC61+2N4gRnWp48b8+vojs+T6JsurrCJbRhXjL gy8adoRwG3zNj+0xh7sHjX7XkIYFwrWMxiFHUaJWMV8pfx6NvGJJTiRR6n1+nKJt scM4MX7RUnLlcmRMbN4HpU4Kg7CLqI3dgiJ1XAgIUyB4Xvsb+Ckp/M8EB9I+GLDP Z4feYJ/cplYpSCcRG0xxHsnqrDFgAI0P/KVy9GQeAaXWWVwQzP5vHr+tauLSaEae q4MCBAMQQ69TX2rSLhnwtH1fpVuBsZibIN3QAikZM///peIXrNcmR4jPBVRPU6p+ ulH8AIb5GRA=sYI9 -----END PGP SIGNATURE-----

-- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . ========================================================================= Ubuntu Security Notice USN-4985-1 June 09, 2021

intel-microcode vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 21.04
  • Ubuntu 20.10
  • Ubuntu 20.04 LTS
  • Ubuntu 18.04 LTS
  • Ubuntu 16.04 ESM
  • Ubuntu 14.04 ESM

Summary:

Several security issues were fixed in Intel Microcode. This may allow a local user to perform a privilege escalation attack. (CVE-2021-24489)

Joseph Nuzman discovered that some Intel processors may not properly apply EIBRS mitigations (originally developed for CVE-2017-5715) and hence may allow unauthorized memory reads via sidechannel attacks. A local attacker could use this to expose sensitive information, including kernel memory. (CVE-2020-24511)

Travis Downs discovered that some Intel processors did not properly flush cache-lines for trivial-data values. This may allow an unauthorized user to infer the presence of these trivial-data-cache-lines via timing sidechannel attacks. A local attacker could use this to expose sensitive information. (CVE-2020-24512)

It was discovered that certain Intel Atom processors could expose memory contents stored in microarchitectural buffers. A local attacker could use this to expose sensitive information. (CVE-2020-24513)

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 21.04: intel-microcode 3.20210608.0ubuntu0.21.04.1

Ubuntu 20.10: intel-microcode 3.20210608.0ubuntu0.20.10.1

Ubuntu 20.04 LTS: intel-microcode 3.20210608.0ubuntu0.20.04.1

Ubuntu 18.04 LTS: intel-microcode 3.20210608.0ubuntu0.18.04.1

Ubuntu 16.04 ESM: intel-microcode 3.20210608.0ubuntu0.16.04.1+esm1

Ubuntu 14.04 ESM: intel-microcode 3.20210608.0ubuntu0.14.04.1+esm1

After a standard system update you need to reboot your computer to make all the necessary changes

Show details on source website

To clipboard 

{
   "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
      affected_products: {
         "@id": "https://www.variotdbs.pl/ref/affected_products",
      },
      configurations: {
         "@id": "https://www.variotdbs.pl/ref/configurations",
      },
      credits: {
         "@id": "https://www.variotdbs.pl/ref/credits",
      },
      cvss: {
         "@id": "https://www.variotdbs.pl/ref/cvss/",
      },
      description: {
         "@id": "https://www.variotdbs.pl/ref/description/",
      },
      exploit_availability: {
         "@id": "https://www.variotdbs.pl/ref/exploit_availability/",
      },
      external_ids: {
         "@id": "https://www.variotdbs.pl/ref/external_ids/",
      },
      iot: {
         "@id": "https://www.variotdbs.pl/ref/iot/",
      },
      iot_taxonomy: {
         "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/",
      },
      patch: {
         "@id": "https://www.variotdbs.pl/ref/patch/",
      },
      problemtype_data: {
         "@id": "https://www.variotdbs.pl/ref/problemtype_data/",
      },
      references: {
         "@id": "https://www.variotdbs.pl/ref/references/",
      },
      sources: {
         "@id": "https://www.variotdbs.pl/ref/sources/",
      },
      sources_release_date: {
         "@id": "https://www.variotdbs.pl/ref/sources_release_date/",
      },
      sources_update_date: {
         "@id": "https://www.variotdbs.pl/ref/sources_update_date/",
      },
      threat_type: {
         "@id": "https://www.variotdbs.pl/ref/threat_type/",
      },
      title: {
         "@id": "https://www.variotdbs.pl/ref/title/",
      },
      type: {
         "@id": "https://www.variotdbs.pl/ref/type/",
      },
   },
   "@id": "https://www.variotdbs.pl/vuln/VAR-202106-0344",
   affected_products: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
         data: {
            "@container": "@list",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
            "@id": "https://www.variotdbs.pl/ref/sources",
         },
      },
      data: [
         {
            model: "linux",
            scope: "eq",
            trust: 1,
            vendor: "debian",
            version: "10.0",
         },
         {
            model: "solidfire bios",
            scope: "eq",
            trust: 1,
            vendor: "netapp",
            version: null,
         },
         {
            model: "hci compute node bios",
            scope: "eq",
            trust: 1,
            vendor: "netapp",
            version: null,
         },
         {
            model: "microcode",
            scope: "lt",
            trust: 1,
            vendor: "intel",
            version: "20210608",
         },
         {
            model: "fas\\/aff bios",
            scope: "eq",
            trust: 1,
            vendor: "netapp",
            version: null,
         },
      ],
      sources: [
         {
            db: "NVD",
            id: "CVE-2020-24512",
         },
      ],
   },
   credits: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/credits#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: "Red Hat",
      sources: [
         {
            db: "PACKETSTORM",
            id: "163924",
         },
         {
            db: "PACKETSTORM",
            id: "163956",
         },
         {
            db: "PACKETSTORM",
            id: "163757",
         },
         {
            db: "PACKETSTORM",
            id: "163772",
         },
         {
            db: "PACKETSTORM",
            id: "163040",
         },
         {
            db: "PACKETSTORM",
            id: "163046",
         },
      ],
      trust: 0.6,
   },
   cve: "CVE-2020-24512",
   cvss: {
      "@context": {
         cvssV2: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#",
            },
            "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2",
         },
         cvssV3: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#",
            },
            "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/",
         },
         severity: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/cvss/severity#",
            },
            "@id": "https://www.variotdbs.pl/ref/cvss/severity",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
            "@id": "https://www.variotdbs.pl/ref/sources",
         },
      },
      data: [
         {
            cvssV2: [
               {
                  accessComplexity: "LOW",
                  accessVector: "LOCAL",
                  authentication: "NONE",
                  author: "nvd@nist.gov",
                  availabilityImpact: "NONE",
                  baseScore: 2.1,
                  confidentialityImpact: "PARTIAL",
                  exploitabilityScore: 3.9,
                  id: "CVE-2020-24512",
                  impactScore: 2.9,
                  integrityImpact: "NONE",
                  severity: "LOW",
                  trust: 1.1,
                  vectorString: "AV:L/AC:L/Au:N/C:P/I:N/A:N",
                  version: "2.0",
               },
               {
                  accessComplexity: "LOW",
                  accessVector: "LOCAL",
                  authentication: "NONE",
                  author: "VULHUB",
                  availabilityImpact: "NONE",
                  baseScore: 2.1,
                  confidentialityImpact: "PARTIAL",
                  exploitabilityScore: 3.9,
                  id: "VHN-178398",
                  impactScore: 2.9,
                  integrityImpact: "NONE",
                  severity: "LOW",
                  trust: 0.1,
                  vectorString: "AV:L/AC:L/AU:N/C:P/I:N/A:N",
                  version: "2.0",
               },
            ],
            cvssV3: [
               {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  author: "nvd@nist.gov",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  exploitabilityScore: 1.8,
                  id: "CVE-2020-24512",
                  impactScore: 1.4,
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  trust: 1,
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.1",
               },
            ],
            severity: [
               {
                  author: "nvd@nist.gov",
                  id: "CVE-2020-24512",
                  trust: 1,
                  value: "LOW",
               },
               {
                  author: "VULHUB",
                  id: "VHN-178398",
                  trust: 0.1,
                  value: "LOW",
               },
               {
                  author: "VULMON",
                  id: "CVE-2020-24512",
                  trust: 0.1,
                  value: "LOW",
               },
            ],
         },
      ],
      sources: [
         {
            db: "VULHUB",
            id: "VHN-178398",
         },
         {
            db: "VULMON",
            id: "CVE-2020-24512",
         },
         {
            db: "NVD",
            id: "CVE-2020-24512",
         },
      ],
   },
   description: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/description#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: "Observable timing discrepancy in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. \n\nFor the stable distribution (buster), these problems have been fixed in\nversion 3.20210608.2~deb10u1. \n\nNote that there are two reported regressions; for some CoffeeLake CPUs\nthis update may break iwlwifi\n(https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/issues/56)\nand some for Skylake R0/D0 CPUs on systems using a very outdated firmware/BIOS,\nthe system may hang on boot:\n(https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/issues/31)\n\nIf you are affected by those issues, you can recover by disabling microcode\nloading on boot (as documented in README.Debian (also available online at\nhttps://salsa.debian.org/hmh/intel-microcode/-/blob/master/debian/README.Debian))\n\nWe recommend that you upgrade your intel-microcode packages. \n\nFor the detailed security status of intel-microcode please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/intel-microcode\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmDXan0ACgkQEMKTtsN8\nTja9aQ//f1dHsEghQsedGnkMCIa2qLi12UFtb4yW7TYV6uwloqbYZMbymvoXYOAB\nhaasn+yCaGUkXuAHxcGvZuN41EkRhdG4LfS5qoZxPMsw84ETjpV2Ohwhuqwf9P20\n9pqV1QLjVPCMiCqvHatkzyRNPtRhIh0uCRx5HtIeOEyKTwhVnUJrrljUXCzMDviD\n3As0n0yVUPDIcJdaVxp5mxyebf1NyIYMR+7wmzTBOhK6i+rEE4NkKGkcsYBIM1ch\nAdTQNHv78QZld6ixL8iCUe1NsSugZ2QjbVL1BLW45fJv3f0BIF5uo6LBzbiJlN/6\nxWwOdFTfqW1ORyr0k6JQ+yKz3oSE+jfUStwf+zegWOjYes5gGaA/nATzzNwwFfCQ\nqDqMmnN26qMI3MswP50ESkNs2JTK3955cIJjnscp5DeFArDuCFKh9wcqSZ46/QCE\nGVRi+F/Dh3JQxv/jP8jfLhCvkBptuendGo9qK5v22QoeCRoHS16dLu7HHP34hRrw\nk//EgtP35pD9eTNiIsxhmx3qTPD0gbQbcMG/5NTVtpNqsffAxYtqTy8+/4lfPkNn\nAYtYrrG6tjEHe1gasLkjthB7c0YLzPLdNyZkNIk6XZ2YIhx18N80c7gTBERSJ1Sh\n9lmsnX3+5GWM7Fx2NN2vL5xIEo0einMJCyTlNMRDLim2ix1vpZg=\n=RVf2\n-----END PGP SIGNATURE-----\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n====================================================================                   \nRed Hat Security Advisory\n\nSynopsis:          Important: microcode_ctl security, bug fix and enhancement update\nAdvisory ID:       RHSA-2021:2305-01\nProduct:           Red Hat Enterprise Linux\nAdvisory URL:      https://access.redhat.com/errata/RHSA-2021:2305\nIssue date:        2021-06-08\nCVE Names:         CVE-2020-24489 CVE-2020-24511 CVE-2020-24512\n                   CVE-2020-24513\n====================================================================\n1. Summary:\n\nAn update for microcode_ctl is now available for Red Hat Enterprise Linux\n7. \n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Enterprise Linux Client (v. 7) - x86_64\nRed Hat Enterprise Linux ComputeNode (v. 7) - x86_64\nRed Hat Enterprise Linux Server (v. 7) - x86_64\nRed Hat Enterprise Linux Workstation (v. 7) - x86_64\n\n3. Description:\n\nThe microcode_ctl packages provide microcode updates for Intel. \n\nSecurity Fix(es):\n\n* hw: vt-d related privilege escalation (CVE-2020-24489)\n\n* hw: improper isolation of shared resources in some Intel Processors\n(CVE-2020-24511)\n\n* hw: observable timing discrepancy in some Intel Processors\n(CVE-2020-24512)\n\n* hw: information disclosure on some Intel Atom processors (CVE-2020-24513)\n\nBug Fix(es) and Enhancement(s):\n\n* Update Intel CPU microcode to microcode-20210525 release\n\n4. Solution:\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied. \n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258\n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1962650 - CVE-2020-24489 hw: vt-d related privilege escalation\n1962666 - CVE-2020-24513 hw: information disclosure on some Intel Atom processors\n1962702 - CVE-2020-24511 hw: improper isolation of shared resources in some Intel Processors\n1962722 - CVE-2020-24512 hw: observable timing discrepancy in some Intel Processors\n\n6. Package List:\n\nRed Hat Enterprise Linux Client (v. 7):\n\nSource:\nmicrocode_ctl-2.1-73.9.el7_9.src.rpm\n\nx86_64:\nmicrocode_ctl-2.1-73.9.el7_9.x86_64.rpm\nmicrocode_ctl-debuginfo-2.1-73.9.el7_9.x86_64.rpm\n\nRed Hat Enterprise Linux ComputeNode (v. 7):\n\nSource:\nmicrocode_ctl-2.1-73.9.el7_9.src.rpm\n\nx86_64:\nmicrocode_ctl-2.1-73.9.el7_9.x86_64.rpm\nmicrocode_ctl-debuginfo-2.1-73.9.el7_9.x86_64.rpm\n\nRed Hat Enterprise Linux Server (v. 7):\n\nSource:\nmicrocode_ctl-2.1-73.9.el7_9.src.rpm\n\nx86_64:\nmicrocode_ctl-2.1-73.9.el7_9.x86_64.rpm\nmicrocode_ctl-debuginfo-2.1-73.9.el7_9.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation (v. 7):\n\nSource:\nmicrocode_ctl-2.1-73.9.el7_9.src.rpm\n\nx86_64:\nmicrocode_ctl-2.1-73.9.el7_9.x86_64.rpm\nmicrocode_ctl-debuginfo-2.1-73.9.el7_9.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security.  Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2020-24489\nhttps://access.redhat.com/security/cve/CVE-2020-24511\nhttps://access.redhat.com/security/cve/CVE-2020-24512\nhttps://access.redhat.com/security/cve/CVE-2020-24513\nhttps://access.redhat.com/security/updates/classification/#important\n\n8. Contact:\n\nThe Red Hat security contact is <secalert@redhat.com>. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2021 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBYMAkjNzjgjWX9erEAQj9Rw//aAXwJWN2Q/e3KJ6n+bdhBXSWxMI+ro7r\n86Elrmw3BY2uTNbkjEorxQfON15ZawMJn0eNprNGA4gxRJ1/OlV+bMXcXsHcxdwt\n2ndTxSL9G3xd+B3j6L8N2YQAXzCSzJT2ohbFPntZeMDpd6hILbNO+XDmnPu0uEsh\nE1Rl1BNsQJGoJ9yrrk9hqae2erlB2nTuDwYcNN6YWANkpWxPnzrJBRt115hBL/Xm\nGh9vsxTC98/V+TWn0o0gLDUr0sM21KhD2U8F3byxBQB4Kr4Y0X34U12whwHkG95b\nm+HKj38OHmwhm+JZV68AsVBbnaa4TM3ilccuAVujxcW10IyXZBsmBFoEnIQ5Y7mm\nX8Bc5goFlKet/cDqwwUDBvjFfXfC61+2N4gRnWp48b8+vojs+T6JsurrCJbRhXjL\ngy8adoRwG3zNj+0xh7sHjX7XkIYFwrWMxiFHUaJWMV8pfx6NvGJJTiRR6n1+nKJt\nscM4MX7RUnLlcmRMbN4HpU4Kg7CLqI3dgiJ1XAgIUyB4Xvsb+Ckp/M8EB9I+GLDP\nZ4feYJ/cplYpSCcRG0xxHsnqrDFgAI0P/KVy9GQeAaXWWVwQzP5vHr+tauLSaEae\nq4MCBAMQQ69TX2rSLhnwtH1fpVuBsZibIN3QAikZM///peIXrNcmR4jPBVRPU6p+\nulH8AIb5GRA=sYI9\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://listman.redhat.com/mailman/listinfo/rhsa-announce\n. =========================================================================\nUbuntu Security Notice USN-4985-1\nJune 09, 2021\n\nintel-microcode vulnerabilities\n=========================================================================\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 21.04\n- Ubuntu 20.10\n- Ubuntu 20.04 LTS\n- Ubuntu 18.04 LTS\n- Ubuntu 16.04 ESM\n- Ubuntu 14.04 ESM\n\nSummary:\n\nSeveral security issues were fixed in Intel Microcode. This may allow a local user to perform a privilege escalation\nattack. (CVE-2021-24489)\n\nJoseph Nuzman discovered that some Intel processors may not properly apply\nEIBRS mitigations (originally developed for CVE-2017-5715) and hence may\nallow unauthorized memory reads via sidechannel attacks. A local attacker\ncould use this to expose sensitive information, including kernel\nmemory. (CVE-2020-24511)\n\nTravis Downs discovered that some Intel processors did not properly flush\ncache-lines for trivial-data values. This may allow an unauthorized user to\ninfer the presence of these trivial-data-cache-lines via timing sidechannel\nattacks. A local attacker could use this to expose sensitive\ninformation. (CVE-2020-24512)\n\nIt was discovered that certain Intel Atom processors could expose memory\ncontents stored in microarchitectural buffers. A local attacker could use\nthis to expose sensitive information. (CVE-2020-24513)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 21.04:\n  intel-microcode                 3.20210608.0ubuntu0.21.04.1\n\nUbuntu 20.10:\n  intel-microcode                 3.20210608.0ubuntu0.20.10.1\n\nUbuntu 20.04 LTS:\n  intel-microcode                 3.20210608.0ubuntu0.20.04.1\n\nUbuntu 18.04 LTS:\n  intel-microcode                 3.20210608.0ubuntu0.18.04.1\n\nUbuntu 16.04 ESM:\n  intel-microcode                 3.20210608.0ubuntu0.16.04.1+esm1\n\nUbuntu 14.04 ESM:\n  intel-microcode                 3.20210608.0ubuntu0.14.04.1+esm1\n\nAfter a standard system update you need to reboot your computer to make\nall the necessary changes",
      sources: [
         {
            db: "NVD",
            id: "CVE-2020-24512",
         },
         {
            db: "VULHUB",
            id: "VHN-178398",
         },
         {
            db: "VULMON",
            id: "CVE-2020-24512",
         },
         {
            db: "PACKETSTORM",
            id: "169079",
         },
         {
            db: "PACKETSTORM",
            id: "163924",
         },
         {
            db: "PACKETSTORM",
            id: "163956",
         },
         {
            db: "PACKETSTORM",
            id: "163757",
         },
         {
            db: "PACKETSTORM",
            id: "163772",
         },
         {
            db: "PACKETSTORM",
            id: "163040",
         },
         {
            db: "PACKETSTORM",
            id: "163046",
         },
         {
            db: "PACKETSTORM",
            id: "163048",
         },
      ],
      trust: 1.8,
   },
   external_ids: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
         data: {
            "@container": "@list",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: [
         {
            db: "NVD",
            id: "CVE-2020-24512",
            trust: 2,
         },
         {
            db: "SIEMENS",
            id: "SSA-309571",
            trust: 1.1,
         },
         {
            db: "PACKETSTORM",
            id: "163040",
            trust: 0.2,
         },
         {
            db: "PACKETSTORM",
            id: "163048",
            trust: 0.2,
         },
         {
            db: "PACKETSTORM",
            id: "163046",
            trust: 0.2,
         },
         {
            db: "PACKETSTORM",
            id: "163037",
            trust: 0.1,
         },
         {
            db: "PACKETSTORM",
            id: "163047",
            trust: 0.1,
         },
         {
            db: "PACKETSTORM",
            id: "163044",
            trust: 0.1,
         },
         {
            db: "PACKETSTORM",
            id: "163042",
            trust: 0.1,
         },
         {
            db: "PACKETSTORM",
            id: "163043",
            trust: 0.1,
         },
         {
            db: "PACKETSTORM",
            id: "163031",
            trust: 0.1,
         },
         {
            db: "PACKETSTORM",
            id: "163032",
            trust: 0.1,
         },
         {
            db: "PACKETSTORM",
            id: "163036",
            trust: 0.1,
         },
         {
            db: "VULHUB",
            id: "VHN-178398",
            trust: 0.1,
         },
         {
            db: "VULMON",
            id: "CVE-2020-24512",
            trust: 0.1,
         },
         {
            db: "PACKETSTORM",
            id: "169079",
            trust: 0.1,
         },
         {
            db: "PACKETSTORM",
            id: "163924",
            trust: 0.1,
         },
         {
            db: "PACKETSTORM",
            id: "163956",
            trust: 0.1,
         },
         {
            db: "PACKETSTORM",
            id: "163757",
            trust: 0.1,
         },
         {
            db: "PACKETSTORM",
            id: "163772",
            trust: 0.1,
         },
      ],
      sources: [
         {
            db: "VULHUB",
            id: "VHN-178398",
         },
         {
            db: "VULMON",
            id: "CVE-2020-24512",
         },
         {
            db: "PACKETSTORM",
            id: "169079",
         },
         {
            db: "PACKETSTORM",
            id: "163924",
         },
         {
            db: "PACKETSTORM",
            id: "163956",
         },
         {
            db: "PACKETSTORM",
            id: "163757",
         },
         {
            db: "PACKETSTORM",
            id: "163772",
         },
         {
            db: "PACKETSTORM",
            id: "163040",
         },
         {
            db: "PACKETSTORM",
            id: "163046",
         },
         {
            db: "PACKETSTORM",
            id: "163048",
         },
         {
            db: "NVD",
            id: "CVE-2020-24512",
         },
      ],
   },
   id: "VAR-202106-0344",
   iot: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/iot#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: true,
      sources: [
         {
            db: "VULHUB",
            id: "VHN-178398",
         },
      ],
      trust: 0.01,
   },
   last_update_date: "2024-11-29T21:31:01.376000Z",
   patch: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/patch#",
         data: {
            "@container": "@list",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: [
         {
            title: "Red Hat: CVE-2020-24512",
            trust: 0.1,
            url: "https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database&qid=CVE-2020-24512",
         },
         {
            title: "Debian CVElist Bug Report Logs: intel-microcode: CVE-2020-24511 CVE-2020-24512 CVE-2020-24513 CVE-2021-24489 (INTEL-SA-00464, INTEL-SA-00465, INTEL-SA-00442)",
            trust: 0.1,
            url: "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs&qid=5d902b5a89823da316827bef43ff1012",
         },
         {
            title: "Debian Security Advisories: DSA-4934-1 intel-microcode -- security update",
            trust: 0.1,
            url: "https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories&qid=4ad7d48e75ab61a8e061047171de2577",
         },
         {
            title: "Arch Linux Issues: ",
            trust: 0.1,
            url: "https://vulmon.com/vendoradvisory?qidtp=arch_linux_issues&qid=CVE-2020-24512 log",
         },
         {
            title: "Arch Linux Advisories: [ASA-202106-34] intel-ucode: multiple issues",
            trust: 0.1,
            url: "https://vulmon.com/vendoradvisory?qidtp=arch_linux_advisories&qid=ASA-202106-34",
         },
         {
            title: "Siemens Security Advisories: Siemens Security Advisory",
            trust: 0.1,
            url: "https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories&qid=240e27e5c8fba28153598a375a2a4130",
         },
         {
            title: "CVE-2020-24512",
            trust: 0.1,
            url: "https://github.com/AlAIAL90/CVE-2020-24512 ",
         },
      ],
      sources: [
         {
            db: "VULMON",
            id: "CVE-2020-24512",
         },
      ],
   },
   problemtype_data: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: [
         {
            problemtype: "CWE-203",
            trust: 1.1,
         },
      ],
      sources: [
         {
            db: "VULHUB",
            id: "VHN-178398",
         },
         {
            db: "NVD",
            id: "CVE-2020-24512",
         },
      ],
   },
   references: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/references#",
         data: {
            "@container": "@list",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: [
         {
            trust: 1.2,
            url: "https://security.netapp.com/advisory/ntap-20210611-0005/",
         },
         {
            trust: 1.2,
            url: "https://www.debian.org/security/2021/dsa-4934",
         },
         {
            trust: 1.2,
            url: "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html",
         },
         {
            trust: 1.2,
            url: "https://lists.debian.org/debian-lts-announce/2021/07/msg00022.html",
         },
         {
            trust: 1.1,
            url: "https://cert-portal.siemens.com/productcert/pdf/ssa-309571.pdf",
         },
         {
            trust: 0.8,
            url: "https://nvd.nist.gov/vuln/detail/cve-2020-24511",
         },
         {
            trust: 0.8,
            url: "https://nvd.nist.gov/vuln/detail/cve-2020-24512",
         },
         {
            trust: 0.7,
            url: "https://access.redhat.com/security/cve/cve-2020-24512",
         },
         {
            trust: 0.7,
            url: "https://nvd.nist.gov/vuln/detail/cve-2020-24489",
         },
         {
            trust: 0.6,
            url: "https://access.redhat.com/security/cve/cve-2020-24511",
         },
         {
            trust: 0.6,
            url: "https://access.redhat.com/articles/11258",
         },
         {
            trust: 0.6,
            url: "https://access.redhat.com/security/cve/cve-2020-24489",
         },
         {
            trust: 0.6,
            url: "https://listman.redhat.com/mailman/listinfo/rhsa-announce",
         },
         {
            trust: 0.6,
            url: "https://access.redhat.com/security/updates/classification/#important",
         },
         {
            trust: 0.6,
            url: "https://access.redhat.com/security/team/key/",
         },
         {
            trust: 0.6,
            url: "https://access.redhat.com/security/team/contact/",
         },
         {
            trust: 0.6,
            url: "https://bugzilla.redhat.com/):",
         },
         {
            trust: 0.4,
            url: "https://nvd.nist.gov/vuln/detail/cve-2020-24513",
         },
         {
            trust: 0.4,
            url: "https://nvd.nist.gov/vuln/detail/cve-2020-8696",
         },
         {
            trust: 0.4,
            url: "https://access.redhat.com/security/cve/cve-2020-8698",
         },
         {
            trust: 0.4,
            url: "https://nvd.nist.gov/vuln/detail/cve-2020-8698",
         },
         {
            trust: 0.4,
            url: "https://nvd.nist.gov/vuln/detail/cve-2020-0549",
         },
         {
            trust: 0.4,
            url: "https://access.redhat.com/security/cve/cve-2020-0543",
         },
         {
            trust: 0.4,
            url: "https://access.redhat.com/security/cve/cve-2020-8695",
         },
         {
            trust: 0.4,
            url: "https://nvd.nist.gov/vuln/detail/cve-2020-8695",
         },
         {
            trust: 0.4,
            url: "https://access.redhat.com/security/cve/cve-2020-0549",
         },
         {
            trust: 0.4,
            url: "https://nvd.nist.gov/vuln/detail/cve-2020-0543",
         },
         {
            trust: 0.4,
            url: "https://access.redhat.com/security/cve/cve-2020-8696",
         },
         {
            trust: 0.4,
            url: "https://nvd.nist.gov/vuln/detail/cve-2020-0548",
         },
         {
            trust: 0.4,
            url: "https://access.redhat.com/security/cve/cve-2020-0548",
         },
         {
            trust: 0.2,
            url: "https://access.redhat.com/security/cve/cve-2020-24513",
         },
         {
            trust: 0.1,
            url: "https://cwe.mitre.org/data/definitions/203.html",
         },
         {
            trust: 0.1,
            url: "https://github.com/alaial90/cve-2020-24512",
         },
         {
            trust: 0.1,
            url: "https://nvd.nist.gov",
         },
         {
            trust: 0.1,
            url: "https://salsa.debian.org/hmh/intel-microcode/-/blob/master/debian/readme.debian))",
         },
         {
            trust: 0.1,
            url: "https://github.com/intel/intel-linux-processor-microcode-data-files/issues/56)",
         },
         {
            trust: 0.1,
            url: "https://www.debian.org/security/faq",
         },
         {
            trust: 0.1,
            url: "https://github.com/intel/intel-linux-processor-microcode-data-files/issues/31)",
         },
         {
            trust: 0.1,
            url: "https://www.debian.org/security/",
         },
         {
            trust: 0.1,
            url: "https://security-tracker.debian.org/tracker/intel-microcode",
         },
         {
            trust: 0.1,
            url: "https://access.redhat.com/errata/rhsa-2021:3255",
         },
         {
            trust: 0.1,
            url: "https://access.redhat.com/errata/rhsa-2021:3322",
         },
         {
            trust: 0.1,
            url: "https://access.redhat.com/errata/rhsa-2021:3027",
         },
         {
            trust: 0.1,
            url: "https://access.redhat.com/errata/rhsa-2021:3029",
         },
         {
            trust: 0.1,
            url: "https://access.redhat.com/errata/rhsa-2021:2307",
         },
         {
            trust: 0.1,
            url: "https://access.redhat.com/errata/rhsa-2021:2305",
         },
         {
            trust: 0.1,
            url: "https://nvd.nist.gov/vuln/detail/cve-2021-24489",
         },
         {
            trust: 0.1,
            url: "https://launchpad.net/ubuntu/+source/intel-microcode/3.20210608.0ubuntu0.20.10.1",
         },
         {
            trust: 0.1,
            url: "https://launchpad.net/ubuntu/+source/intel-microcode/3.20210608.0ubuntu0.21.04.1",
         },
         {
            trust: 0.1,
            url: "https://launchpad.net/ubuntu/+source/intel-microcode/3.20210608.0ubuntu0.20.04.1",
         },
         {
            trust: 0.1,
            url: "https://launchpad.net/ubuntu/+source/intel-microcode/3.20210608.0ubuntu0.18.04.1",
         },
         {
            trust: 0.1,
            url: "https://ubuntu.com/security/notices/usn-4985-1",
         },
      ],
      sources: [
         {
            db: "VULHUB",
            id: "VHN-178398",
         },
         {
            db: "VULMON",
            id: "CVE-2020-24512",
         },
         {
            db: "PACKETSTORM",
            id: "169079",
         },
         {
            db: "PACKETSTORM",
            id: "163924",
         },
         {
            db: "PACKETSTORM",
            id: "163956",
         },
         {
            db: "PACKETSTORM",
            id: "163757",
         },
         {
            db: "PACKETSTORM",
            id: "163772",
         },
         {
            db: "PACKETSTORM",
            id: "163040",
         },
         {
            db: "PACKETSTORM",
            id: "163046",
         },
         {
            db: "PACKETSTORM",
            id: "163048",
         },
         {
            db: "NVD",
            id: "CVE-2020-24512",
         },
      ],
   },
   sources: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/sources#",
         data: {
            "@container": "@list",
         },
      },
      data: [
         {
            db: "VULHUB",
            id: "VHN-178398",
         },
         {
            db: "VULMON",
            id: "CVE-2020-24512",
         },
         {
            db: "PACKETSTORM",
            id: "169079",
         },
         {
            db: "PACKETSTORM",
            id: "163924",
         },
         {
            db: "PACKETSTORM",
            id: "163956",
         },
         {
            db: "PACKETSTORM",
            id: "163757",
         },
         {
            db: "PACKETSTORM",
            id: "163772",
         },
         {
            db: "PACKETSTORM",
            id: "163040",
         },
         {
            db: "PACKETSTORM",
            id: "163046",
         },
         {
            db: "PACKETSTORM",
            id: "163048",
         },
         {
            db: "NVD",
            id: "CVE-2020-24512",
         },
      ],
   },
   sources_release_date: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
         data: {
            "@container": "@list",
         },
      },
      data: [
         {
            date: "2021-06-09T00:00:00",
            db: "VULHUB",
            id: "VHN-178398",
         },
         {
            date: "2021-06-09T00:00:00",
            db: "VULMON",
            id: "CVE-2020-24512",
         },
         {
            date: "2021-06-28T19:12:00",
            db: "PACKETSTORM",
            id: "169079",
         },
         {
            date: "2021-08-27T19:22:22",
            db: "PACKETSTORM",
            id: "163924",
         },
         {
            date: "2021-08-31T15:44:21",
            db: "PACKETSTORM",
            id: "163956",
         },
         {
            date: "2021-08-09T14:15:37",
            db: "PACKETSTORM",
            id: "163757",
         },
         {
            date: "2021-08-10T14:49:53",
            db: "PACKETSTORM",
            id: "163772",
         },
         {
            date: "2021-06-09T13:40:18",
            db: "PACKETSTORM",
            id: "163040",
         },
         {
            date: "2021-06-09T13:42:01",
            db: "PACKETSTORM",
            id: "163046",
         },
         {
            date: "2021-06-09T13:42:19",
            db: "PACKETSTORM",
            id: "163048",
         },
         {
            date: "2021-06-09T19:15:08.930000",
            db: "NVD",
            id: "CVE-2020-24512",
         },
      ],
   },
   sources_update_date: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
         data: {
            "@container": "@list",
         },
      },
      data: [
         {
            date: "2021-09-09T00:00:00",
            db: "VULHUB",
            id: "VHN-178398",
         },
         {
            date: "2021-08-10T00:00:00",
            db: "VULMON",
            id: "CVE-2020-24512",
         },
         {
            date: "2021-09-09T12:56:22.933000",
            db: "NVD",
            id: "CVE-2020-24512",
         },
      ],
   },
   threat_type: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: "local",
      sources: [
         {
            db: "PACKETSTORM",
            id: "163048",
         },
      ],
      trust: 0.1,
   },
   title: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/title#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: "Debian Security Advisory 4934-1",
      sources: [
         {
            db: "PACKETSTORM",
            id: "169079",
         },
      ],
      trust: 0.1,
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.