Critical Access Control Vulnerability in Intel Microcode Package
Summary
UBUNTU-CVE-2024-39279: Insufficient granularity of access control in UEFI firmware in some Intel(R) processors may allow a authenticated user to potentially enable denial of service via local access. Affects intel-microcode versions 1.20130906.1ubuntu2 – 3.20210608.0ubuntu0.14.04.1+esm1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Intel Microcode package is essential for updating the microcode of Intel processors, ensuring optimal performance and security. It plays a crucial role in maintaining system stability and security by providing updates that address hardware-level issues. However, certain versions of this package are vulnerable to an access control issue that could allow unauthorized users to exploit the system.
Vulnerability Detail
The vulnerability, identified as CVE-2024-39279, stems from insufficient granularity of access control in UEFI firmware present in some Intel processors. This flaw may permit an authenticated user to potentially enable denial of service through local access. The ramifications of this vulnerability are significant, as it could lead to system instability and unauthorized access to critical system functions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can limit physical access to the system to prevent unauthorized users from exploiting this vulnerability until a patch is applied.
Conclusion
The Intel Microcode package has a critical vulnerability (CVE-2024-39279) that can be exploited by authenticated users to enable denial of service. Users are encouraged to update to the latest patched version to secure their systems and mitigate risks associated with this vulnerability.
See every vulnerability recorded for intel-microcode →
FAQ
CVE-2024-39279 is a vulnerability in the Intel Microcode package that allows authenticated users to potentially enable denial of service via local access due to insufficient access control in UEFI firmware.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The vulnerability may lead to system instability and unauthorized access to critical system functions, which could compromise the overall security of the system.
Yes, patched versions of the Intel Microcode package are available for various Ubuntu distributions. Users should update to the latest version to mitigate the risk.
If you cannot apply the patch immediately, it is advisable to restrict physical access to the system to prevent potential exploitation of the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for intel-microcode.
