Intel Microcode Vulnerability: CVE-2022-38090 - Information Disclosure Risk
Summary
UBUNTU-CVE-2022-38090: Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard Extensions may allow a privileged user to potentially enable information disclosure via local access. Affects intel-microcode versions 1.20130906.1ubuntu2 – 3.20210608.0ubuntu0.14.04.1+esm1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'intel-microcode' package provides microcode updates for Intel processors, enhancing their performance and security. It is critical for maintaining system stability and security, especially in environments relying on Intel's Software Guard Extensions (SGX). This package is essential for users running Ubuntu versions 14.04, 16.04, 18.04, 20.04, 22.04, and is particularly vulnerable to improper isolation of shared resources, which can lead to information disclosure.
Vulnerability Detail
CVE-2022-38090 arises from improper isolation of shared resources in some Intel processors when utilizing Intel Software Guard Extensions (SGX). This vulnerability allows a privileged user to potentially enable information disclosure via local access, posing a significant risk to sensitive data. The vulnerability affects multiple versions of the intel-microcode package across various Ubuntu distributions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, consider limiting access to the system for privileged users and monitoring system logs for any unauthorized access attempts. However, the best approach is to apply the patch as soon as possible.
Conclusion
CVE-2022-38090 is a significant vulnerability affecting the intel-microcode package across multiple Ubuntu versions, posing a risk of information disclosure. It is crucial to update to the latest patched versions to mitigate this risk effectively.
See every vulnerability recorded for intel-microcode →
FAQ
CVE-2022-38090 is a vulnerability in Intel processors that allows a privileged user to potentially enable information disclosure via local access due to improper isolation of shared resources.
The vulnerability affects Ubuntu versions 14.04, 16.04, 18.04, 20.04, and 22.04.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of CVE-2022-38090 is 4.4, indicating a medium severity level.
If immediate updates are not possible, limit access to the system for privileged users and monitor for unauthorized access attempts as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for intel-microcode.
