Intel Microcode Vulnerabilities: Exposing Sensitive Information
Summary
USN-4385-1: intel-microcode vulnerabilities. Affects intel-microcode versions < 3.20200609.0ubuntu0.14.04.0. Fixed in 3.20200609.0ubuntu0.14.04.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The intel-microcode package provides microcode updates for Intel processors, enhancing their performance and security. It plays a critical role in ensuring that the CPU operates efficiently and securely by applying necessary updates to the processor's firmware. However, vulnerabilities have been identified that could allow local attackers to exploit sensitive information stored in microarchitectural registers.
Vulnerability Detail
Multiple vulnerabilities have been discovered in the intel-microcode package, specifically affecting Intel client and Xeon E3 processors. These vulnerabilities include CVE-2020-0543, CVE-2020-0548, and CVE-2020-0549. They allow local attackers to potentially expose sensitive information through memory contents that may be briefly accessible after certain operations. This could lead to unauthorized access to confidential data, posing a significant security risk.
How To Fix
Minimum fixed version
3.20200609.0ubuntu0.14.04.0
This is the first release that contains the fix.
sudo apt-get install --only-upgrade intel-microcodeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for mitigating the vulnerabilities without applying the updates. It is recommended to ensure that systems are regularly updated and monitored for any security patches.
Conclusion
The intel-microcode vulnerabilities pose a significant risk to systems using affected Intel processors. It is crucial to update the package to the latest patched versions to mitigate these risks. Regular monitoring and updates are essential for maintaining system security.
See every vulnerability recorded for intel-microcode →
FAQ
The main vulnerabilities include CVE-2020-0543, CVE-2020-0548, and CVE-2020-0549, which could allow local attackers to expose sensitive information.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerabilities using the Vulert playground at Vulert Scanner.
No subscription is required for updating the intel-microcode package on Ubuntu 16.04, 18.04, and 20.04. However, Ubuntu Pro is required for 14.04.
While no specific workarounds are available, ensure that your system is monitored for any security patches and consider isolating sensitive operations until the update can be applied.
Detailed information about the vulnerabilities can be found in the Ubuntu Security Notices at https://github.com/canonical/ubuntu-security-notices.
Related vulnerabilities
Recent vulnerabilities recorded for intel-microcode.
