Intel Microcode Update Regression - USN-4628-2
Summary
USN-4628-2: intel-microcode regression. Affects intel-microcode versions < 3.20201110.0ubuntu0.14.04.2. Fixed in 3.20201110.0ubuntu0.14.04.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The intel-microcode package provides updates to the Intel processor microcode, which is essential for the proper functioning of Intel CPUs. This package ensures that processors operate efficiently and securely by applying necessary updates that address bugs and vulnerabilities. The recent update, however, introduced a regression affecting certain Intel Tiger Lake processors, preventing them from booting successfully.
Vulnerability Detail
The vulnerability stems from an update in USN-4628-1 that inadvertently caused boot failures in specific Intel Tiger Lake processors. This issue arose due to improper handling of microcode updates, which can lead to system instability and prevent the affected processors from initializing correctly. Additionally, the update was linked to several security vulnerabilities (CVE-2020-8695, CVE-2020-8696, CVE-2020-8698) that allowed local attackers to exploit sensitive information through power consumption measurements and improper resource isolation.
How To Fix
Minimum fixed version
3.20201110.0ubuntu0.14.04.2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade intel-microcodeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can add the 'dis_ucode_ldr' kernel command line option in the boot menu to disable microcode loading. This can help in booting the system successfully while the issue is being resolved.
Conclusion
In summary, the intel-microcode package has a critical regression that affects Intel Tiger Lake processors, leading to boot failures. Users are advised to update to the patched version of the package and consider the provided workaround to mitigate the issue temporarily. Monitoring tools like Vulert can help keep track of vulnerabilities in your software.
See every vulnerability recorded for intel-microcode →
FAQ
The intel-microcode package provides essential updates to Intel processors, ensuring they function correctly and securely by applying necessary microcode updates.
The boot failure was caused by a regression introduced in the microcode update provided in USN-4628-1, which affected the initialization of certain Intel Tiger Lake processors.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The vulnerability could allow local attackers to exploit sensitive information through power consumption measurements and improper resource isolation, potentially leading to data exposure.
Yes, you can add the 'dis_ucode_ldr' option in the boot menu to disable microcode loading, which may allow your system to boot successfully.
References
Related vulnerabilities
Recent vulnerabilities recorded for intel-microcode.
