Critical Security Update for microcode_ctl: Addressing Multiple Vulnerabilities in Intel and AMD Processors
Summary
ALSA-2024:9401: Moderate: microcode_ctl security update. Affects microcode_ctl versions < 4:20240910-1.el9_5. Fixed in 4:20240910-1.el9_5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The microcode_ctl package is essential for providing microcode updates to Intel and AMD processors, ensuring optimal performance and security. This package plays a crucial role in maintaining the integrity of processor operations by updating the low-level firmware that controls the CPU. However, vulnerabilities in this package can lead to severe security risks, including privilege escalation and information disclosure.
Vulnerability Detail
The microcode_ctl package has been identified with several vulnerabilities that could allow local privilege escalation, information disclosure, and potential denial of service on affected Intel processors. Notable vulnerabilities include CVE-2023-22655, which allows local privilege escalation on Intel Xeon processors, and CVE-2023-28746, which permits local information disclosure on Intel Atom processors. These vulnerabilities stem from flaws in the microcode that can be exploited by malicious users to gain unauthorized access or disrupt system operations.
How To Fix
Minimum fixed version
4:20240910-1.el9_5
This is the first release that contains the fix.
sudo dnf update microcode_ctlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for these vulnerabilities. The best course of action is to apply the security update as soon as it becomes available.
Conclusion
The microcode_ctl package has been found to contain multiple vulnerabilities that pose significant security risks to systems using affected Intel and AMD processors. It is imperative to update the package to the latest version to safeguard against potential exploits. Regular monitoring and timely updates are essential for maintaining system security.
See every vulnerability recorded for microcode_ctl →
FAQ
microcode_ctl is a package that provides microcode updates for Intel and AMD processors, enhancing their performance and security.
The vulnerabilities include local privilege escalation, information disclosure, and potential denial of service on various Intel processors.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
While there are no specific workarounds, it is crucial to prioritize the update to mitigate the risks associated with these vulnerabilities.
For detailed information about the security issues, including CVSS scores and acknowledgments, refer to the CVE pages linked in the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for microcode_ctl.
