Critical Information Disclosure Vulnerability in Intel Microcode
Summary
UBUNTU-CVE-2024-23984: Observable discrepancy in RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access. Affects intel-microcode versions 1.20130906.1ubuntu2 – 3.20210608.0ubuntu0.14.04.1+esm1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Intel Microcode is a crucial component of Intel processors that updates the processor's internal control logic to improve performance and security. It plays a vital role in ensuring that the CPU operates correctly and securely. However, vulnerabilities in microcode can expose systems to significant risks, including information disclosure and unauthorized access.
Vulnerability Detail
The vulnerability identified as CVE-2024-23984 arises from an observable discrepancy in the RAPL (Running Average Power Limit) interface for certain Intel processors. This flaw may allow a privileged user to potentially enable information disclosure through local access. The implications of this vulnerability are serious, as it could lead to unauthorized access to sensitive information, impacting the confidentiality of data processed by affected systems.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users may limit access to the affected systems to trusted personnel only, thereby reducing the risk of exploitation until the patch is applied.
Conclusion
CVE-2024-23984 represents a significant security risk for systems using affected versions of Intel Microcode. It is crucial for users to apply the available patches promptly to mitigate the risk of information disclosure. Regular monitoring and updates are essential to maintain system security.
See every vulnerability recorded for intel-microcode →
FAQ
CVE-2024-23984 is a vulnerability in Intel Microcode that allows a privileged user to potentially enable information disclosure via local access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The vulnerability may lead to unauthorized access to sensitive information, compromising the confidentiality of data processed by affected systems.
Yes, a patched version of the Intel Microcode is available. Users should update to version 3.20240910.0ubuntu0.20.04.1 or later.
If you cannot apply the patch immediately, limit access to the affected systems to trusted personnel as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for intel-microcode.
