Critical Access Control Vulnerability in Intel Microcode Package
Summary
UBUNTU-CVE-2024-36293: Improper access control in the EDECCSSA user leaf function for some Intel(R) Processors with Intel(R) SGX may allow an authenticated user to potentially enable denial of service via local access. Affects intel-microcode versions 1.20130906.1ubuntu2 – 3.20210608.0ubuntu0.14.04.1+esm1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Intel Microcode package is essential for updating the microcode of Intel processors, which helps in enhancing performance and security. This package is widely used across various Ubuntu distributions, including LTS versions. The vulnerability in question affects the EDECCSSA user leaf function, which is critical for maintaining secure operations in Intel processors with SGX (Software Guard Extensions).
Vulnerability Detail
The vulnerability, identified as CVE-2024-36293, stems from improper access control in the EDECCSSA user leaf function for certain Intel processors. This flaw allows an authenticated user to potentially enable denial of service via local access, posing a significant risk to system integrity and availability. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is recommended to apply the patch as soon as it becomes available.
Conclusion
In summary, CVE-2024-36293 is a critical vulnerability affecting the Intel Microcode package, allowing potential denial of service through improper access control. Users are urged to update their packages to the latest patched versions to ensure system security.
See every vulnerability recorded for intel-microcode →
FAQ
CVE-2024-36293 is a vulnerability in the Intel Microcode package that allows an authenticated user to potentially enable denial of service via local access.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can check your application for this vulnerability using the Vulert playground.
The vulnerability can lead to denial of service, affecting the availability and integrity of systems utilizing the affected Intel processors.
Yes, a patched version of the Intel Microcode package is available. Users should update to the latest version to mitigate the risk.
The CVSS score for CVE-2024-36293 is 6.5, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for intel-microcode.
