[USN-6797-1] Intel Microcode vulnerabilities

Severity High

Affected Packages 6

CVEs 9

Several security issues were fixed in Intel Microcode.

It was discovered that some 3rd and 4th Generation Intel® Xeon® Processors
did not properly restrict access to certain hardware features when using
Intel® SGX or Intel® TDX. This may allow a privileged local user to
potentially further escalate their privileges on the system. This issue only
affected Ubuntu 23.10, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04 LTS and
Ubuntu 16.04 LTS. (CVE-2023-22655)

It was discovered that some Intel® Atom® Processors did not properly clear
register state when performing various operations. A local attacker could
use this to obtain sensitive information via a transient execution attack.
This issue only affected Ubuntu 23.10, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS,
Ubuntu 18.04 LTS and Ubuntu 16.04 LTS. (CVE-2023-28746)

It was discovered that some Intel® Processors did not properly clear the
state of various hardware structures when switching execution contexts. A
local attacker could use this to access privileged information. This issue only
affected Ubuntu 23.10, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04 LTS and
Ubuntu 16.04 LTS. (CVE-2023-38575)

It was discovered that some Intel® Processors did not properly enforce bus
lock regulator protections. A remote attacker could use this to cause a
denial of service. This issue only affected Ubuntu 23.10, Ubuntu 22.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 18.04 LTS and Ubuntu 16.04 LTS. (CVE-2023-39368)

It was discovered that some Intel® Xeon® D Processors did not properly
calculate the SGX base key when using Intel® SGX. A privileged local
attacker could use this to obtain sensitive information. This issue only
affected Ubuntu 23.10, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04 LTS and
Ubuntu 16.04 LTS. (CVE-2023-43490)

It was discovered that some Intel® Processors did not properly protect against
concurrent accesses. A local attacker could use this to obtain sensitive
information. (CVE-2023-45733)

It was discovered that some Intel® Processors TDX module software did not
properly validate input. A privileged local attacker could use this information
to potentially further escalate their privileges on the system.
(CVE-2023-45745, CVE-2023-47855)

It was discovered that some Intel® Core™ Ultra processors did not properly
handle particular instruction sequences. A local attacker could use this
issue to cause a denial of service. (CVE-2023-46103)

Package	Affected Version
pkg:deb/ubuntu/intel-microcode?distro=xenial	< 3.20240514.0ubuntu0.16.04.1+esm1
pkg:deb/ubuntu/intel-microcode?distro=noble	< 3.20240514.0ubuntu0.24.04.1
pkg:deb/ubuntu/intel-microcode?distro=mantic	< 3.20240514.0ubuntu0.23.10.1
pkg:deb/ubuntu/intel-microcode?distro=jammy	< 3.20240514.0ubuntu0.22.04.1
pkg:deb/ubuntu/intel-microcode?distro=focal	< 3.20240514.0ubuntu0.20.04.1
pkg:deb/ubuntu/intel-microcode?distro=bionic	< 3.20240514.0ubuntu0.18.04.1+esm1

ID

USN-6797-1

Severity

high

Severity from

CVE-2023-45745

URL

https://ubuntu.com/security/notices/USN-6797-1

Published

2024-05-29T07:13:42
(3 months ago)

Modified

2024-05-29T07:13:42
(3 months ago)

Other Advisories

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform
Affected	pkg:deb/ubuntu/intel-microcode?distro=xenial	ubuntu	intel-microcode	< 3.20240514.0ubuntu0.16.04.1+esm1	xenial
Affected	pkg:deb/ubuntu/intel-microcode?distro=noble	ubuntu	intel-microcode	< 3.20240514.0ubuntu0.24.04.1	noble
Affected	pkg:deb/ubuntu/intel-microcode?distro=mantic	ubuntu	intel-microcode	< 3.20240514.0ubuntu0.23.10.1	mantic
Affected	pkg:deb/ubuntu/intel-microcode?distro=jammy	ubuntu	intel-microcode	< 3.20240514.0ubuntu0.22.04.1	jammy
Affected	pkg:deb/ubuntu/intel-microcode?distro=focal	ubuntu	intel-microcode	< 3.20240514.0ubuntu0.20.04.1	focal
Affected	pkg:deb/ubuntu/intel-microcode?distro=bionic	ubuntu	intel-microcode	< 3.20240514.0ubuntu0.18.04.1+esm1	bionic

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date