Denial of Service Vulnerability in Intel Microcode Package
Summary
ALPINE-CVE-2024-39355: Improper handling of physical or environmental conditions in some Intel(R) Processors may allow an authenticated user to enable denial of service via local access. Affects intel-ucode versions < 20250211-r0. Fixed in 20250211-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'intel-ucode' package is a critical component in Alpine Linux distributions, providing microcode updates for Intel processors. This package ensures that the processors operate efficiently and securely by applying necessary updates that address hardware-level issues. However, vulnerabilities in this package can expose systems to risks, particularly in environments where physical or environmental conditions can be manipulated.
Vulnerability Detail
The vulnerability identified as ALPINE-CVE-2024-39355 arises from improper handling of physical or environmental conditions in some Intel processors. This flaw allows an authenticated user to potentially enable a denial of service (DoS) attack through local access. The ramifications of this vulnerability could lead to system instability or unavailability, impacting the overall performance and reliability of affected systems.
How To Fix
Minimum fixed version
20250211-r0
This is the first release that contains the fix.
sudo apk add --upgrade intel-ucodeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, it is advisable to restrict local access to systems running the affected version of the 'intel-ucode' package until the package can be updated. Implementing strict access controls can help mitigate the risk of exploitation.
Conclusion
The ALPINE-CVE-2024-39355 vulnerability in the intel-ucode package poses a significant risk of denial of service through local access. It is crucial for users to update to the patched version to safeguard their systems. Additionally, implementing access controls can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for intel-ucode →
FAQ
The vulnerability allows an authenticated user to enable denial of service via local access due to improper handling of physical or environmental conditions.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The potential impacts include system instability and unavailability, which can disrupt operations and affect performance.
Yes, a patch is available. Users should update to version 20250211-r0 of the intel-ucode package to fix the vulnerability.
If immediate updates are not possible, restrict local access to the affected systems as a temporary measure to mitigate risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for intel-ucode.
