Sign-up

ID

VAR-202106-0344


CVE

CVE-2020-24512


TITLE

Intel Processors Information disclosure vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-202106-633

DESCRIPTION

Observable timing discrepancy in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. For the stable distribution (buster), these problems have been fixed in version 3.20210608.2~deb10u1. Note that there are two reported regressions; for some CoffeeLake CPUs this update may break iwlwifi (https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/issues/56) and some for Skylake R0/D0 CPUs on systems using a very outdated firmware/BIOS, the system may hang on boot: (https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/issues/31) If you are affected by those issues, you can recover by disabling microcode loading on boot (as documented in README.Debian (also available online at https://salsa.debian.org/hmh/intel-microcode/-/blob/master/debian/README.Debian)) We recommend that you upgrade your intel-microcode packages. For the detailed security status of intel-microcode please refer to its security tracker page at: https://security-tracker.debian.org/tracker/intel-microcode Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmDXan0ACgkQEMKTtsN8 Tja9aQ//f1dHsEghQsedGnkMCIa2qLi12UFtb4yW7TYV6uwloqbYZMbymvoXYOAB haasn+yCaGUkXuAHxcGvZuN41EkRhdG4LfS5qoZxPMsw84ETjpV2Ohwhuqwf9P20 9pqV1QLjVPCMiCqvHatkzyRNPtRhIh0uCRx5HtIeOEyKTwhVnUJrrljUXCzMDviD 3As0n0yVUPDIcJdaVxp5mxyebf1NyIYMR+7wmzTBOhK6i+rEE4NkKGkcsYBIM1ch AdTQNHv78QZld6ixL8iCUe1NsSugZ2QjbVL1BLW45fJv3f0BIF5uo6LBzbiJlN/6 xWwOdFTfqW1ORyr0k6JQ+yKz3oSE+jfUStwf+zegWOjYes5gGaA/nATzzNwwFfCQ qDqMmnN26qMI3MswP50ESkNs2JTK3955cIJjnscp5DeFArDuCFKh9wcqSZ46/QCE GVRi+F/Dh3JQxv/jP8jfLhCvkBptuendGo9qK5v22QoeCRoHS16dLu7HHP34hRrw k//EgtP35pD9eTNiIsxhmx3qTPD0gbQbcMG/5NTVtpNqsffAxYtqTy8+/4lfPkNn AYtYrrG6tjEHe1gasLkjthB7c0YLzPLdNyZkNIk6XZ2YIhx18N80c7gTBERSJ1Sh 9lmsnX3+5GWM7Fx2NN2vL5xIEo0einMJCyTlNMRDLim2ix1vpZg= =RVf2 -----END PGP SIGNATURE----- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: microcode_ctl security, bug fix and enhancement update Advisory ID: RHSA-2021:2305-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:2305 Issue date: 2021-06-08 CVE Names: CVE-2020-24489 CVE-2020-24511 CVE-2020-24512 CVE-2020-24513 ==================================================================== 1. Summary: An update for microcode_ctl is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 3. Description: The microcode_ctl packages provide microcode updates for Intel. Security Fix(es): * hw: vt-d related privilege escalation (CVE-2020-24489) * hw: improper isolation of shared resources in some Intel Processors (CVE-2020-24511) * hw: observable timing discrepancy in some Intel Processors (CVE-2020-24512) * hw: information disclosure on some Intel Atom processors (CVE-2020-24513) Bug Fix(es) and Enhancement(s): * Update Intel CPU microcode to microcode-20210525 release 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1962650 - CVE-2020-24489 hw: vt-d related privilege escalation 1962666 - CVE-2020-24513 hw: information disclosure on some Intel Atom processors 1962702 - CVE-2020-24511 hw: improper isolation of shared resources in some Intel Processors 1962722 - CVE-2020-24512 hw: observable timing discrepancy in some Intel Processors 6. Package List: Red Hat Enterprise Linux Client (v. 7): Source: microcode_ctl-2.1-73.9.el7_9.src.rpm x86_64: microcode_ctl-2.1-73.9.el7_9.x86_64.rpm microcode_ctl-debuginfo-2.1-73.9.el7_9.x86_64.rpm Red Hat Enterprise Linux ComputeNode (v. 7): Source: microcode_ctl-2.1-73.9.el7_9.src.rpm x86_64: microcode_ctl-2.1-73.9.el7_9.x86_64.rpm microcode_ctl-debuginfo-2.1-73.9.el7_9.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: microcode_ctl-2.1-73.9.el7_9.src.rpm x86_64: microcode_ctl-2.1-73.9.el7_9.x86_64.rpm microcode_ctl-debuginfo-2.1-73.9.el7_9.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: microcode_ctl-2.1-73.9.el7_9.src.rpm x86_64: microcode_ctl-2.1-73.9.el7_9.x86_64.rpm microcode_ctl-debuginfo-2.1-73.9.el7_9.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2020-24489 https://access.redhat.com/security/cve/CVE-2020-24511 https://access.redhat.com/security/cve/CVE-2020-24512 https://access.redhat.com/security/cve/CVE-2020-24513 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYMAkjNzjgjWX9erEAQj9Rw//aAXwJWN2Q/e3KJ6n+bdhBXSWxMI+ro7r 86Elrmw3BY2uTNbkjEorxQfON15ZawMJn0eNprNGA4gxRJ1/OlV+bMXcXsHcxdwt 2ndTxSL9G3xd+B3j6L8N2YQAXzCSzJT2ohbFPntZeMDpd6hILbNO+XDmnPu0uEsh E1Rl1BNsQJGoJ9yrrk9hqae2erlB2nTuDwYcNN6YWANkpWxPnzrJBRt115hBL/Xm Gh9vsxTC98/V+TWn0o0gLDUr0sM21KhD2U8F3byxBQB4Kr4Y0X34U12whwHkG95b m+HKj38OHmwhm+JZV68AsVBbnaa4TM3ilccuAVujxcW10IyXZBsmBFoEnIQ5Y7mm X8Bc5goFlKet/cDqwwUDBvjFfXfC61+2N4gRnWp48b8+vojs+T6JsurrCJbRhXjL gy8adoRwG3zNj+0xh7sHjX7XkIYFwrWMxiFHUaJWMV8pfx6NvGJJTiRR6n1+nKJt scM4MX7RUnLlcmRMbN4HpU4Kg7CLqI3dgiJ1XAgIUyB4Xvsb+Ckp/M8EB9I+GLDP Z4feYJ/cplYpSCcRG0xxHsnqrDFgAI0P/KVy9GQeAaXWWVwQzP5vHr+tauLSaEae q4MCBAMQQ69TX2rSLhnwtH1fpVuBsZibIN3QAikZM///peIXrNcmR4jPBVRPU6p+ ulH8AIb5GRA=sYI9 -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce

Trust: 1.62

sources: NVD: CVE-2020-24512 // VULHUB: VHN-178398 // PACKETSTORM: 169079 // PACKETSTORM: 163956 // PACKETSTORM: 163032 // PACKETSTORM: 163037 // PACKETSTORM: 163042 // PACKETSTORM: 163043 // PACKETSTORM: 163046

AFFECTED PRODUCTS

vendor:debianmodel:linuxscope:eqversion:10.0

Trust: 1.0

vendor:netappmodel:solidfire biosscope:eqversion: -

Trust: 1.0

vendor:netappmodel:hci compute node biosscope:eqversion: -

Trust: 1.0

vendor:intelmodel:microcodescope:ltversion:20210608

Trust: 1.0

vendor:netappmodel:fas\/aff biosscope:eqversion: -

Trust: 1.0

sources: NVD: CVE-2020-24512

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-24512
value: LOW

Trust: 1.0

CNNVD: CNNVD-202106-633
value: LOW

Trust: 0.6

VULHUB: VHN-178398
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2020-24512
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

VULHUB: VHN-178398
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2020-24512
baseSeverity: LOW
baseScore: 3.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 1.8
impactScore: 1.4
version: 3.1

Trust: 1.0

sources: VULHUB: VHN-178398 // CNNVD: CNNVD-202106-633 // NVD: CVE-2020-24512

PROBLEMTYPE DATA

problemtype:CWE-203

Trust: 1.1

sources: VULHUB: VHN-178398 // NVD: CVE-2020-24512

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202106-633

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-202106-633

PATCH

title:Intel Processors Repair measures for information disclosure vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=153291

Trust: 0.6

sources: CNNVD: CNNVD-202106-633

EXTERNAL IDS

db:NVDid:CVE-2020-24512

Trust: 2.4

db:SIEMENSid:SSA-309571

Trust: 1.7

db:PACKETSTORMid:163031

Trust: 0.7

db:AUSCERTid:ESB-2021.2243

Trust: 0.6

db:AUSCERTid:ESB-2023.2479

Trust: 0.6

db:AUSCERTid:ESB-2021.4047

Trust: 0.6

db:AUSCERTid:ESB-2021.2088

Trust: 0.6

db:AUSCERTid:ESB-2021.2721

Trust: 0.6

db:AUSCERTid:ESB-2021.2797

Trust: 0.6

db:AUSCERTid:ESB-2021.3443

Trust: 0.6

db:AUSCERTid:ESB-2021.2258

Trust: 0.6

db:AUSCERTid:ESB-2021.2537

Trust: 0.6

db:AUSCERTid:ESB-2021.2905

Trust: 0.6

db:AUSCERTid:ESB-2021.2945

Trust: 0.6

db:AUSCERTid:ESB-2021.2010

Trust: 0.6

db:AUSCERTid:ESB-2021.2672

Trust: 0.6

db:CS-HELPid:SB2021081834

Trust: 0.6

db:CS-HELPid:SB2021080917

Trust: 0.6

db:CS-HELPid:SB2021083127

Trust: 0.6

db:CS-HELPid:SB2021081125

Trust: 0.6

db:CS-HELPid:SB2021062128

Trust: 0.6

db:CS-HELPid:SB2021062701

Trust: 0.6

db:PACKETSTORMid:163863

Trust: 0.6

db:PACKETSTORMid:163993

Trust: 0.6

db:PACKETSTORMid:163757

Trust: 0.6

db:PACKETSTORMid:163772

Trust: 0.6

db:ICS CERTid:ICSA-21-222-05

Trust: 0.6

db:LENOVOid:LEN-62742

Trust: 0.6

db:CNNVDid:CNNVD-202106-633

Trust: 0.6

db:PACKETSTORMid:163037

Trust: 0.2

db:PACKETSTORMid:163042

Trust: 0.2

db:PACKETSTORMid:163043

Trust: 0.2

db:PACKETSTORMid:163032

Trust: 0.2

db:PACKETSTORMid:163046

Trust: 0.2

db:PACKETSTORMid:163047

Trust: 0.1

db:PACKETSTORMid:163044

Trust: 0.1

db:PACKETSTORMid:163040

Trust: 0.1

db:PACKETSTORMid:163048

Trust: 0.1

db:PACKETSTORMid:163036

Trust: 0.1

db:VULHUBid:VHN-178398

Trust: 0.1

db:PACKETSTORMid:169079

Trust: 0.1

db:PACKETSTORMid:163956

Trust: 0.1

sources: VULHUB: VHN-178398 // PACKETSTORM: 169079 // PACKETSTORM: 163956 // PACKETSTORM: 163032 // PACKETSTORM: 163037 // PACKETSTORM: 163042 // PACKETSTORM: 163043 // PACKETSTORM: 163046 // CNNVD: CNNVD-202106-633 // NVD: CVE-2020-24512

REFERENCES

url:https://cert-portal.siemens.com/productcert/pdf/ssa-309571.pdf

Trust: 1.7

url:https://security.netapp.com/advisory/ntap-20210611-0005/

Trust: 1.7

url:https://www.debian.org/security/2021/dsa-4934

Trust: 1.7

url:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html

Trust: 1.7

url:https://lists.debian.org/debian-lts-announce/2021/07/msg00022.html

Trust: 1.7

url:https://access.redhat.com/security/cve/cve-2020-24512

Trust: 1.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-24511

Trust: 0.7

url:https://nvd.nist.gov/vuln/detail/cve-2020-24512

Trust: 0.7

url:https://nvd.nist.gov/vuln/detail/cve-2020-24489

Trust: 0.7

url:https://nvd.nist.gov/vuln/detail/cve-2020-24513

Trust: 0.6

url:https://access.redhat.com/security/cve/cve-2020-24511

Trust: 0.6

url:https://access.redhat.com/articles/11258

Trust: 0.6

url:https://access.redhat.com/security/cve/cve-2020-24489

Trust: 0.6

url:https://listman.redhat.com/mailman/listinfo/rhsa-announce

Trust: 0.6

url:https://access.redhat.com/security/updates/classification/#important

Trust: 0.6

url:https://access.redhat.com/security/team/key/

Trust: 0.6

url:https://access.redhat.com/security/team/contact/

Trust: 0.6

url:https://bugzilla.redhat.com/):

Trust: 0.6

url:https://packetstormsecurity.com/files/163863/red-hat-security-advisory-2021-3176-01.html

Trust: 0.6

url:https://support.lenovo.com/us/en/product_security/len-62742

Trust: 0.6

url:https://packetstormsecurity.com/files/163757/red-hat-security-advisory-2021-3027-01.html

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021081834

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.2537

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2023.2479

Trust: 0.6

url:https://www.ibm.com/support/pages/node/6520482

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.2243

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.2088

Trust: 0.6

url:https://packetstormsecurity.com/files/163772/red-hat-security-advisory-2021-3029-01.html

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021062128

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021062701

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.4047

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021081125

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021083127

Trust: 0.6

url:https://us-cert.cisa.gov/ics/advisories/icsa-21-222-05

Trust: 0.6

url:https://packetstormsecurity.com/files/163993/red-hat-security-advisory-2021-3364-01.html

Trust: 0.6

url:https://packetstormsecurity.com/files/163031/red-hat-security-advisory-2021-2299-01.html

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.2905

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.2721

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021080917

Trust: 0.6

url:https://vigilance.fr/vulnerability/intel-processor-information-disclosure-via-shared-resources-35664

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.2945

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.2672

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.2010

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.2258

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.2797

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.3443

Trust: 0.6

url:https://access.redhat.com/security/cve/cve-2020-24513

Trust: 0.5

url:https://salsa.debian.org/hmh/intel-microcode/-/blob/master/debian/readme.debian))

Trust: 0.1

url:https://github.com/intel/intel-linux-processor-microcode-data-files/issues/56)

Trust: 0.1

url:https://www.debian.org/security/faq

Trust: 0.1

url:https://github.com/intel/intel-linux-processor-microcode-data-files/issues/31)

Trust: 0.1

url:https://www.debian.org/security/

Trust: 0.1

url:https://security-tracker.debian.org/tracker/intel-microcode

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-8696

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-8698

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-8698

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-0549

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-0543

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-8695

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-8695

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-0549

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2021:3322

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-0543

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-8696

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-0548

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-0548

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2021:2302

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2021:2306

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2021:2308

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2021:2301

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2021:2305

Trust: 0.1

sources: VULHUB: VHN-178398 // PACKETSTORM: 169079 // PACKETSTORM: 163956 // PACKETSTORM: 163032 // PACKETSTORM: 163037 // PACKETSTORM: 163042 // PACKETSTORM: 163043 // PACKETSTORM: 163046 // CNNVD: CNNVD-202106-633 // NVD: CVE-2020-24512

CREDITS

Red Hat

Trust: 0.6

sources: PACKETSTORM: 163956 // PACKETSTORM: 163032 // PACKETSTORM: 163037 // PACKETSTORM: 163042 // PACKETSTORM: 163043 // PACKETSTORM: 163046

SOURCES

db:VULHUBid:VHN-178398
db:PACKETSTORMid:169079
db:PACKETSTORMid:163956
db:PACKETSTORMid:163032
db:PACKETSTORMid:163037
db:PACKETSTORMid:163042
db:PACKETSTORMid:163043
db:PACKETSTORMid:163046
db:CNNVDid:CNNVD-202106-633
db:NVDid:CVE-2020-24512

LAST UPDATE DATE

2024-12-21T22:23:23.918000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-178398date:2021-09-09T00:00:00
db:CNNVDid:CNNVD-202106-633date:2023-05-04T00:00:00
db:NVDid:CVE-2020-24512date:2021-09-09T12:56:22.933

SOURCES RELEASE DATE

db:VULHUBid:VHN-178398date:2021-06-09T00:00:00
db:PACKETSTORMid:169079date:2021-06-28T19:12:00
db:PACKETSTORMid:163956date:2021-08-31T15:44:21
db:PACKETSTORMid:163032date:2021-06-09T13:26:50
db:PACKETSTORMid:163037date:2021-06-09T13:28:17
db:PACKETSTORMid:163042date:2021-06-09T13:40:32
db:PACKETSTORMid:163043date:2021-06-09T13:40:40
db:PACKETSTORMid:163046date:2021-06-09T13:42:01
db:CNNVDid:CNNVD-202106-633date:2021-06-08T00:00:00
db:NVDid:CVE-2020-24512date:2021-06-09T19:15:08.930