Security Update for microcode_ctl: Addressing Multiple UEFI Firmware Vulnerabilities
Summary
ALSA-2025:7043: Moderate: microcode_ctl security update. Affects microcode_ctl versions < 4:20250211-1.el9_6. Fixed in 4:20250211-1.el9_6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The microcode_ctl package is essential for providing microcode updates for Intel and AMD processors. It plays a critical role in ensuring that the processors operate efficiently and securely by applying necessary updates that enhance performance and fix known issues. However, vulnerabilities in the UEFI firmware can expose systems to various security risks, making it crucial to address these issues promptly.
Vulnerability Detail
The microcode_ctl package has been identified with several vulnerabilities related to improper input validation, insufficient granularity of access control, and improper initialization in the UEFI firmware. These vulnerabilities (CVE-2024-28047, CVE-2024-39279, CVE-2024-31157) could potentially allow unauthorized access or manipulation of system firmware, leading to severe security breaches.
How To Fix
Minimum fixed version
4:20250211-1.el9_6
This is the first release that contains the fix.
sudo dnf update microcode_ctlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for these vulnerabilities. The best course of action is to apply the security update as soon as it becomes available.
Conclusion
The vulnerabilities in the microcode_ctl package pose significant security risks that must be addressed promptly. Updating to the latest patched version is essential to safeguard your system against potential threats. Utilize tools like Vulert to stay informed about vulnerabilities in your software.
See every vulnerability recorded for microcode_ctl →
FAQ
microcode_ctl is a package that provides microcode updates for Intel and AMD processors, ensuring they operate securely and efficiently.
The vulnerabilities include improper input validation, insufficient access control, and improper initialization in UEFI firmware, which could lead to unauthorized access.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
While there are no specific workarounds, it is crucial to prioritize the update as soon as possible to mitigate the risks associated with these vulnerabilities.
For more details about the security issues, including CVSS scores and acknowledgments, refer to the CVE pages listed in the References section of the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for microcode_ctl.
