Denial of Service Vulnerability in Intel Microcode Packages Across Multiple Ubuntu Versions
Summary
UBUNTU-CVE-2024-39355: Improper handling of physical or environmental conditions in some Intel(R) Processors may allow an authenticated user to enable denial of service via local access. Affects intel-microcode versions 1.20130906.1ubuntu2 – 3.20210608.0ubuntu0.14.04.1+esm1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Intel Microcode is a crucial component in Intel processors that provides updates to the processor's firmware, enhancing performance and security. This package is essential for maintaining system stability and security by addressing known issues in Intel hardware. However, certain versions of the Intel Microcode package across various Ubuntu LTS releases are susceptible to a vulnerability that could allow an authenticated user to exploit physical or environmental conditions, leading to potential denial of service.
Vulnerability Detail
The vulnerability, identified as CVE-2024-39355, arises from improper handling of physical or environmental conditions in some Intel processors. This flaw allows an authenticated user with local access to potentially enable denial of service, impacting system availability. The vulnerability has been assigned a CVSS score of 6.5, indicating a medium severity level. It is crucial for users of affected systems to understand the implications of this vulnerability and take appropriate action to mitigate risks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can limit local access to systems running affected versions of the Intel Microcode package. This can be achieved by implementing stricter access controls and monitoring local user activities to prevent unauthorized exploitation of the vulnerability.
Conclusion
The CVE-2024-39355 vulnerability in Intel Microcode packages poses a significant risk of denial of service for users of various Ubuntu versions. It is essential to update to the latest patched version of the package to mitigate this risk. Users should also consider implementing temporary workarounds to enhance security until updates can be applied.
See every vulnerability recorded for intel-microcode →
FAQ
CVE-2024-39355 is a vulnerability in Intel Microcode that allows an authenticated user to enable denial of service through improper handling of physical or environmental conditions.
The affected Ubuntu versions include 14.04 LTS, 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, 24.04 LTS, and 24.10.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If immediate updates are not possible, consider implementing stricter access controls to limit local access to the affected systems as a temporary workaround.
The CVSS score of CVE-2024-39355 is 6.5, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for intel-microcode.
