Escalation of Privilege Vulnerability in Intel Microcode Packages
Summary
UBUNTU-CVE-2020-24489: Incomplete cleanup in some Intel(R) VT-d products may allow an authenticated user to potentially enable escalation of privilege via local access. Affects intel-microcode versions < 3.20210608.0ubuntu0.14.04.1+esm1. Fixed in 3.20210608.0ubuntu0.14.04.1+esm1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Intel Microcode is a critical component that provides updates to the processor's firmware, enhancing performance and security. It is essential for maintaining system stability and security, particularly in environments that rely on Intel processors. This vulnerability affects multiple versions of the Intel Microcode package across various Ubuntu LTS distributions, exposing systems to potential privilege escalation risks.
Vulnerability Detail
The vulnerability, identified as CVE-2020-24489, arises from incomplete cleanup in certain Intel VT-d products. This flaw allows an authenticated user to potentially escalate privileges via local access, which could lead to unauthorized access to sensitive information or system control. The vulnerability is particularly concerning due to its high CVSS score of 8.8, indicating a significant risk to affected systems.
How To Fix
Minimum fixed version
3.20210608.0ubuntu0.14.04.1+esm1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade intel-microcodeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit local access to the affected systems until the package is updated. This can be done by restricting user permissions and ensuring that only trusted users have access to the system.
Conclusion
The CVE-2020-24489 vulnerability in Intel Microcode poses a significant risk of privilege escalation for systems running affected versions of the package. Users are strongly advised to update to the patched versions provided for their respective Ubuntu LTS distributions to mitigate this risk.
See every vulnerability recorded for intel-microcode →
FAQ
CVE-2020-24489 is a vulnerability in Intel Microcode that allows an authenticated user to escalate privileges via local access.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
The CVSS score for this vulnerability is 8.8, indicating a high severity risk.
No subscription is required to update the Intel Microcode package for Ubuntu 18.04 LTS and 20.04 LTS.
If immediate updates are not possible, consider restricting local access to the system as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for intel-microcode.
