Arch Linux alert ASA-202106-34 (intel-ucode)
| From: | Santiago Torres-Arias via arch-security <arch-security@lists.archlinux.org> | |
| To: | Archlinux security <arch-security@archlinux.org> | |
| Subject: | [ASA-202106-34] intel-ucode: multiple issues | |
| Date: | Thu, 17 Jun 2021 12:24:27 -0400 | |
| Message-ID: | <YMt3O96spMPN+6u3@LykOS.localdomain> | |
| Cc: | Santiago Torres-Arias <santiago@archlinux.org> |
Arch Linux Security Advisory ASA-202106-34 ========================================== Severity: High Date : 2021-06-15 CVE-ID : CVE-2020-24511 CVE-2020-24512 CVE-2020-24513 CVE-2021-24489 Package : intel-ucode Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-2051 Summary ======= The package intel-ucode before version 20210608-1 is vulnerable to multiple issues including privilege escalation and information disclosure. Resolution ========== Upgrade to 20210608-1. # pacman -Syu "intel-ucode>=20210608-1" The problems have been fixed upstream in version 20210608. Workaround ========== None. Description =========== - CVE-2020-24511 (information disclosure) Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. - CVE-2020-24512 (information disclosure) Observable timing discrepancy in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. - CVE-2020-24513 (information disclosure) Domain-bypass transient execution vulnerability in some Intel Atom(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. - CVE-2021-24489 (privilege escalation) Incomplete cleanup in some Intel(R) VT-d products may allow an authenticated user to potentially enable escalation of privilege via local access. Impact ====== A local attacker could escalate privileges or disclose sensitive information about the processor state using a side-channel attack. References ========== https://www.intel.com/content/www/us/en/security-center/a... https://github.com/intel/Intel-Linux-Processor-Microcode-... https://www.intel.com/content/www/us/en/security-center/a... https://www.intel.com/content/www/us/en/security-center/a... https://security.archlinux.org/CVE-2020-24511 https://security.archlinux.org/CVE-2020-24512 https://security.archlinux.org/CVE-2020-24513 https://security.archlinux.org/CVE-2021-24489