Intel SGX Access Control Vulnerability in intel-ucode Package
Summary
ALPINE-CVE-2024-36293: Improper access control in the EDECCSSA user leaf function for some Intel(R) Processors with Intel(R) SGX may allow an authenticated user to potentially enable denial of service via local access. Affects intel-ucode versions < 20250211-r0. Fixed in 20250211-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The intel-ucode package provides microcode updates for Intel processors, enhancing system stability and performance. It plays a critical role in ensuring that the CPU operates efficiently by applying necessary updates. However, certain versions of this package are vulnerable to an improper access control issue that affects Intel's Software Guard Extensions (SGX), potentially compromising system security.
Vulnerability Detail
The vulnerability identified as ALPINE-CVE-2024-36293 stems from improper access control in the EDECCSSA user leaf function for specific Intel processors utilizing Intel SGX. This flaw allows an authenticated user to potentially enable denial of service through local access. The implications of this vulnerability are significant, as it could lead to system instability and unauthorized access to sensitive operations within the SGX environment.
How To Fix
Minimum fixed version
20250211-r0
This is the first release that contains the fix.
sudo apk add --upgrade intel-ucodeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit local access to the affected systems to mitigate the risk of exploitation until the package is updated. Additionally, monitoring system logs for unusual access patterns may help in identifying potential misuse.
Conclusion
The intel-ucode package has a critical vulnerability that could allow unauthorized access and denial of service due to improper access control in Intel SGX. Users are strongly advised to update to the patched version to secure their systems against potential exploitation.
See every vulnerability recorded for intel-ucode →
FAQ
The vulnerability is an improper access control issue in the EDECCSSA user leaf function of Intel SGX, allowing potential denial of service.
The vulnerability affects intel-ucode versions in Alpine Linux v3.18 to v3.22, specifically before the fixed version 20250211-r0.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploitation of this vulnerability could lead to denial of service, affecting system stability and potentially exposing sensitive operations.
Yes, the permanent fix is to update the intel-ucode package to version 20250211-r0 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for intel-ucode.
