Intel Microcode Vulnerability in Ubuntu Packages: Information Disclosure Risk
Summary
UBUNTU-CVE-2024-28047: Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access. Affects intel-microcode versions 1.20130906.1ubuntu2 – 3.20210608.0ubuntu0.14.04.1+esm1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Intel microcode is a critical component of Intel processors that provides updates and fixes to the processor's firmware. It plays a vital role in ensuring the stability and security of systems running on Intel hardware. The vulnerability identified as CVE-2024-28047 affects multiple versions of the intel-microcode package across various Ubuntu LTS releases, potentially exposing systems to information disclosure risks.
Vulnerability Detail
The vulnerability arises from improper input validation in the UEFI firmware for certain Intel processors. This flaw may allow a privileged user to access sensitive information via local access, posing a risk to system confidentiality. The vulnerability has been assigned a CVSS score of 5.3, indicating a medium severity level, which necessitates prompt attention to mitigate potential exploitation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can limit local access to systems running affected versions of the intel-microcode package. This can be achieved by implementing stricter access controls and ensuring that only authorized personnel can access the system physically.
Conclusion
The intel-microcode vulnerability (CVE-2024-28047) poses a significant risk of information disclosure for users of affected Ubuntu versions. It is crucial to update the package to the latest version to mitigate this risk. Users should also consider implementing temporary workarounds to enhance security until the update is applied.
See every vulnerability recorded for intel-microcode →
FAQ
CVE-2024-28047 is a vulnerability in the intel-microcode package that allows for potential information disclosure due to improper input validation in UEFI firmware.
The vulnerability affects multiple Ubuntu LTS versions, including 14.04, 16.04, 18.04, 20.04, 22.04, and 24.04, as well as the 24.10 release.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updates are not possible, implement stricter access controls to limit physical access to the affected systems as a temporary workaround.
The CVSS score of CVE-2024-28047 is 5.3, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for intel-microcode.
