[USN-4385-1] Intel Microcode vulnerabilities

Severity Medium

Affected Packages 5

CVEs 3

Several security issues were fixed in Intel Microcode.

It was discovered that memory contents previously stored in
microarchitectural special registers after RDRAND, RDSEED, and SGX EGETKEY
read operations on Intel client and Xeon E3 processors may be briefly
exposed to processes on the same or different processor cores. A local
attacker could use this to expose sensitive information. (CVE-2020-0543)

It was discovered that on some Intel processors, partial data values
previously read from a vector register on a physical core may be propagated
into unused portions of the store buffer. A local attacker could possible
use this to expose sensitive information. (CVE-2020-0548)

It was discovered that on some Intel processors, data from the most
recently evicted modified L1 data cache (L1D) line may be propagated into
an unused (invalid) L1D fill buffer. A local attacker could possibly use
this to expose sensitive information. (CVE-2020-0549)

Package	Affected Version
pkg:deb/ubuntu/intel-microcode?distro=xenial	< 3.20200609.0ubuntu0.16.04.0
pkg:deb/ubuntu/intel-microcode?distro=trusty	< 3.20200609.0ubuntu0.14.04.0
pkg:deb/ubuntu/intel-microcode?distro=focal	< 3.20200609.0ubuntu0.20.04.0
pkg:deb/ubuntu/intel-microcode?distro=eoan	< 3.20200609.0ubuntu0.19.10.0
pkg:deb/ubuntu/intel-microcode?distro=bionic	< 3.20200609.0ubuntu0.18.04.0

ID

USN-4385-1

Severity

medium

URL

https://ubuntu.com/security/notices/USN-4385-1

Published

2020-06-09T18:42:32
(4 years ago)

Modified

2020-06-09T18:42:32
(4 years ago)

Other Advisories

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform
Affected	pkg:deb/ubuntu/intel-microcode?distro=xenial	ubuntu	intel-microcode	< 3.20200609.0ubuntu0.16.04.0	xenial
Affected	pkg:deb/ubuntu/intel-microcode?distro=trusty	ubuntu	intel-microcode	< 3.20200609.0ubuntu0.14.04.0	trusty
Affected	pkg:deb/ubuntu/intel-microcode?distro=focal	ubuntu	intel-microcode	< 3.20200609.0ubuntu0.20.04.0	focal
Affected	pkg:deb/ubuntu/intel-microcode?distro=eoan	ubuntu	intel-microcode	< 3.20200609.0ubuntu0.19.10.0	eoan
Affected	pkg:deb/ubuntu/intel-microcode?distro=bionic	ubuntu	intel-microcode	< 3.20200609.0ubuntu0.18.04.0	bionic

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date