Intel Microcode Vulnerability: Information Disclosure Risk in Ubuntu Packages
Summary
UBUNTU-CVE-2020-0548: Cleanup errors in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Affects intel-microcode versions < 3.20200609.0ubuntu0.14.04.0. Fixed in 3.20200609.0ubuntu0.14.04.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'intel-microcode' package provides microcode updates for Intel processors, enhancing system stability and performance. It is crucial for maintaining the security and efficiency of systems running on Intel hardware. This package is available across various Ubuntu LTS versions, including 14.04, 16.04, 18.04, and 20.04. The vulnerability in question affects these versions, potentially allowing unauthorized information disclosure.
Vulnerability Detail
The vulnerability, identified as CVE-2020-0548, stems from cleanup errors in certain Intel processors. An authenticated user could exploit this flaw to enable information disclosure through local access. The issue poses a significant risk as it could lead to sensitive data being exposed, impacting the confidentiality of the system.
How To Fix
Minimum fixed version
3.20200609.0ubuntu0.14.04.0
This is the first release that contains the fix.
sudo apt-get install --only-upgrade intel-microcodeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds have been provided for this vulnerability. The best course of action is to apply the available updates as soon as possible.
Conclusion
CVE-2020-0548 represents a significant vulnerability in the Intel microcode package across multiple Ubuntu LTS versions. Users are strongly advised to update their systems to the patched versions to prevent potential information disclosure risks.
See every vulnerability recorded for intel-microcode →
FAQ
CVE-2020-0548 is a vulnerability in Intel microcode that may allow an authenticated user to disclose sensitive information through local access.
The vulnerability affects Ubuntu LTS versions 14.04, 16.04, 18.04, and 20.04.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring signup.
The CVSS score of CVE-2020-0548 is 5.5, indicating a medium severity level.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risk of information disclosure.
Related vulnerabilities
Recent vulnerabilities recorded for intel-microcode.
