CVE-2020-8698: Information Disclosure in Intel Processors
Summary
CVE-2020-8698: Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Affects intel-ucode across 3 version ranges.
< 20201110-r0
< 20201112-r0
< 20210216-r0
Fixed in 20201110-r0, 20201112-r0 or 20210216-r0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'intel-ucode' package is an open-source microcode package for Intel processors. It provides updates to the microcode, which is responsible for controlling the behavior of the processor. The package is commonly used in Alpine Linux distributions.
Vulnerability Detail
The vulnerability identified as CVE-2020-8698 is a result of improper isolation of shared resources in certain Intel processors. An authenticated user with local access may exploit this vulnerability to enable information disclosure. The exact details of the information that can be disclosed are not specified.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo apk add --upgrade intel-ucode-
< 20201110-r020201110-r0 -
< 20201112-r020201112-r0 -
< 20210216-r020210216-r0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
CVE-2020-8698 is a vulnerability in the 'intel-ucode' package that can potentially enable information disclosure on systems with certain Intel processors. To mitigate this vulnerability, it is recommended to update the package to the fixed version. If you require further assistance or support in addressing this vulnerability, you can reach out to DevNack.com.
See every vulnerability recorded for intel-ucode →
FAQ
The vulnerability may allow an authenticated user to disclose sensitive information on the affected system.
An authenticated user with local access to the system can potentially exploit this vulnerability.
No known exploit has been reported for this vulnerability at the time of this report.
No, only certain Intel processors are affected. The specific processors impacted are not mentioned in the vulnerability details.
For more detailed information about this vulnerability, you can refer to the source link provided in the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for intel-ucode.
