Denial of Service Vulnerability in Intel Microcode Package
Summary
UBUNTU-CVE-2024-21853: Improper finite state machines (FSMs) in the hardware logic in some 4th and 5th Generation Intel(R) Xeon(R) Processors may allow an authorized user to potentially enable denial of service via local access. Affects intel-microcode versions 1.20130906.1ubuntu2 – 3.20210608.0ubuntu0.14.04.1+esm1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Intel Microcode package is essential for updating the microcode of Intel processors, which helps improve performance and security. It is particularly crucial for maintaining the stability and reliability of systems running on Intel hardware. This package is widely used across various Ubuntu LTS versions, making it a critical component for many users and organizations relying on Intel processors.
Vulnerability Detail
The vulnerability identified as CVE-2024-21853 arises from improper finite state machines (FSMs) in the hardware logic of certain 4th and 5th Generation Intel Xeon Processors. This flaw may allow an authorized user to potentially enable denial of service via local access, which could disrupt system operations and lead to significant downtime. The vulnerability has a CVSS score of 4.7, indicating a medium severity level that necessitates prompt attention.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users may consider restricting local access to the affected systems to mitigate the risk of exploitation until the package can be updated.
Conclusion
The CVE-2024-21853 vulnerability in the Intel Microcode package poses a risk of denial of service for systems using specific Intel processors. Users are encouraged to update their packages promptly to mitigate this risk and ensure system stability.
See every vulnerability recorded for intel-microcode →
FAQ
CVE-2024-21853 is a vulnerability in the Intel Microcode package that may allow an authorized user to enable denial of service on systems using certain Intel processors.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring signup.
If an immediate update is not possible, restrict local access to the affected systems as a temporary measure to reduce the risk of exploitation.
The vulnerability affects multiple Ubuntu LTS versions, including 14.04, 16.04, 18.04, 20.04, 22.04, and 24.04.
The CVSS score for CVE-2024-21853 is 4.7, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for intel-microcode.
