Critical Access Control Vulnerability in Intel Microcode Package
Summary
UBUNTU-CVE-2021-33117: Improper access control for some 3rd Generation Intel(R) Xeon(R) Scalable Processors before BIOS version MR7, may allow a local attacker to potentially enable information disclosure via local access. Affects intel-microcode versions 1.20130906.1ubuntu2 – 3.20210608.0ubuntu0.14.04.1+esm1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Intel Microcode package is essential for the proper functioning of Intel processors, providing updates that enhance performance and security. It is particularly important for 3rd Generation Intel Xeon Scalable Processors, which are widely used in enterprise environments. This package ensures that the processors operate efficiently and securely, but it has been found to have a significant vulnerability that could be exploited by local attackers.
Vulnerability Detail
The vulnerability, identified as CVE-2021-33117, arises from improper access control in some 3rd Generation Intel Xeon Scalable Processors prior to BIOS version MR7. This flaw may allow a local attacker to potentially enable information disclosure via local access. The implications of this vulnerability are serious, as it could lead to unauthorized access to sensitive information stored on affected systems, thereby compromising data integrity and confidentiality.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the necessary updates as soon as they are available.
Conclusion
In summary, CVE-2021-33117 is a critical vulnerability affecting the Intel Microcode package, particularly for 3rd Generation Intel Xeon Scalable Processors. It poses a risk of information disclosure to local attackers. Users are strongly advised to update their systems to the latest patched versions to mitigate this risk.
See every vulnerability recorded for intel-microcode →
FAQ
CVE-2021-33117 is a vulnerability in the Intel Microcode package that allows local attackers to potentially enable information disclosure.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software without needing to install anything. Simply upload your manifest file to check for vulnerabilities.
If exploited, this vulnerability could lead to unauthorized access to sensitive information, potentially compromising data integrity and confidentiality.
Yes, there are patched versions available for various Ubuntu distributions. It is recommended to update to the latest version of the Intel Microcode package.
The CVSS score for CVE-2021-33117 is 5.5, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for intel-microcode.
