AMD Microcode Vulnerability: Timing and Power-Based Side Channel Attack
Summary
UBUNTU-CVE-2021-26318: A timing and power-based side channel attack leveraging the x86 PREFETCH instructions on some AMD CPUs could potentially result in leaked kernel address space information. Affects amd64-microcode versions 1.20120910-3 – 3.20180524.1~ubuntu0.14.04.2+really20130710.1ubuntu1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The amd64-microcode package provides microcode updates for AMD processors, enhancing performance and security. This package is crucial for maintaining the stability and efficiency of systems running on AMD hardware. However, it is susceptible to a timing and power-based side channel attack that could expose sensitive kernel address space information.
Vulnerability Detail
A timing and power-based side channel attack leveraging the x86 PREFETCH instructions on some AMD CPUs could potentially result in leaked kernel address space information. This vulnerability arises from the way certain AMD processors handle prefetch instructions, which can be exploited to infer sensitive data. The ramifications of this vulnerability include unauthorized access to critical system information, potentially leading to further exploitation or data breaches.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can limit the exposure by disabling certain CPU features or applying kernel parameters that mitigate the effects of the vulnerability. However, these workarounds may affect system performance and should be implemented with caution.
Conclusion
The amd64-microcode vulnerability presents a significant risk to systems using affected AMD processors. Users are urged to update their packages promptly to mitigate the risk of exploitation. Regular monitoring and updates are essential to maintaining system security.
See every vulnerability recorded for amd64-microcode →
FAQ
The CVSS score of this vulnerability is 4.7, indicating a medium severity level.
The vulnerability affects systems running on AMD CPUs that utilize the amd64-microcode package across various Ubuntu LTS versions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The potential consequences include unauthorized access to sensitive kernel address space information, which could lead to further exploitation or data breaches.
Yes, the permanent fix is to update the amd64-microcode package to the latest version that addresses the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for amd64-microcode.
