Information Disclosure Vulnerability in Intel Microcode Package
Summary
UBUNTU-CVE-2020-8695: Observable discrepancy in the RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access. Affects intel-microcode versions < 3.20201110.0ubuntu0.14.04.1. Fixed in 3.20201110.0ubuntu0.14.04.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Intel Microcode package is a critical component in Ubuntu systems that provides updates to the microcode of Intel processors. This package ensures that the CPU operates correctly and securely by applying necessary fixes and enhancements. However, certain versions of this package have been found to have vulnerabilities that could potentially expose sensitive information to privileged users.
Vulnerability Detail
The vulnerability identified as CVE-2020-8695 arises from an observable discrepancy in the RAPL (Running Average Power Limit) interface for some Intel processors. This flaw may allow a privileged user to enable information disclosure via local access, potentially compromising system integrity. The vulnerability affects multiple versions of the Intel Microcode package across various Ubuntu LTS distributions, including 14.04, 16.04, 18.04, and 20.04.
How To Fix
Minimum fixed version
3.20201110.0ubuntu0.14.04.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade intel-microcodeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patches as soon as possible.
Conclusion
CVE-2020-8695 is a significant vulnerability in the Intel Microcode package that can lead to information disclosure for privileged users. It is essential to update to the patched versions of the package across affected Ubuntu distributions to ensure system security.
See every vulnerability recorded for intel-microcode →
FAQ
CVE-2020-8695 is a vulnerability in the Intel Microcode package that allows privileged users to potentially disclose sensitive information through the RAPL interface.
The vulnerability affects Ubuntu LTS versions 14.04, 16.04, 18.04, and 20.04.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2020-8695 is 5.5, indicating a medium severity level.
While there are no specific workarounds, it is crucial to prioritize updating the package to mitigate the risk of information disclosure.
Related vulnerabilities
Recent vulnerabilities recorded for intel-microcode.
