Insufficient Access Control in Linux Kernel Driver for Intel Processors
Summary
CVE-2020-8694: Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Affects intel-ucode across 2 version ranges.
< 20201110-r0
< 20201112-r0
Fixed in 20201110-r0 or 20201112-r0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'intel-ucode' package is an open-source microcode package for Intel processors. It provides updates to the processor microcode, which is responsible for controlling the behavior of the processor. The package is commonly used in Alpine Linux distributions, specifically versions 3.13 to 3.18.
Vulnerability Detail
The vulnerability, identified as CVE-2020-8694, is an insufficient access control issue in the Linux kernel driver for some Intel Processors. An authenticated user with local access may exploit this vulnerability to enable information disclosure. The exact details of the information that can be disclosed are not specified.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo apk add --upgrade intel-ucode-
< 20201110-r020201110-r0 -
< 20201112-r020201112-r0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The 'intel-ucode' package in Alpine Linux versions 3.13 to 3.18 is vulnerable to an insufficient access control issue in the Linux kernel driver for some Intel Processors. This vulnerability can potentially enable information disclosure through local access. It is recommended to update the 'intel-ucode' package to the fixed version specified for each Alpine Linux version. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for intel-ucode →
FAQ
The vulnerability allows an authenticated user to potentially enable information disclosure through local access. The exact nature of the disclosed information is not specified.
Users of Alpine Linux versions 3.13 to 3.18 who have the 'intel-ucode' package installed are affected by this vulnerability.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package manifest file, such as package-lock.json, and the tool will provide real-time alerts for open-source vulnerabilities.
No known exploits for this vulnerability have been reported at the time of this report.
You can find more information about this vulnerability in the CVE-2020-8694 JSON report available at https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-8694.json
Related vulnerabilities
Recent vulnerabilities recorded for intel-ucode.
