Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2021.2945
microcode_ctl security, bug fix and enhancement update
1 September 2021
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: microcode_ctl
Publisher: Red Hat
Operating System: Red Hat
Impact/Access: Execute Arbitrary Code/Commands -- Existing Account
Increased Privileges -- Existing Account
Access Confidential Data -- Existing Account
Reduced Security -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2020-24512 CVE-2020-24511 CVE-2020-24489
CVE-2020-8698 CVE-2020-8696 CVE-2020-8695
CVE-2020-0549 CVE-2020-0548 CVE-2020-0543
Reference: ESB-2021.2940
ESB-2021.2797
ESB-2021.2537
Original Bulletin:
https://access.redhat.com/errata/RHSA-2021:3364
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: microcode_ctl security, bug fix and enhancement update
Advisory ID: RHSA-2021:3364-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2021:3364
Issue date: 2021-08-31
CVE Names: CVE-2020-0543 CVE-2020-0548 CVE-2020-0549
CVE-2020-8695 CVE-2020-8696 CVE-2020-8698
CVE-2020-24489 CVE-2020-24511 CVE-2020-24512
=====================================================================
1. Summary:
An update for microcode_ctl is now available for Red Hat Enterprise Linux
8.2 Extended User Support.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux BaseOS EUS (v. 8.2) - x86_64
3. Description:
The microcode_ctl packages provide microcode updates for Intel.
Security Fix(es):
* hw: Vector Register Data Sampling (CVE-2020-0548)
* hw: L1D Cache Eviction Sampling (CVE-2020-0549)
* hw: Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543)
* hw: Information disclosure issue in Intel SGX via RAPL interface
(CVE-2020-8695)
* hw: Vector Register Leakage-Active (CVE-2020-8696)
* hw: Fast forward store predictor (CVE-2020-8698)
* hw: vt-d related privilege escalation (CVE-2020-24489)
* hw: improper isolation of shared resources in some Intel Processors
(CVE-2020-24511)
* hw: observable timing discrepancy in some Intel Processors
(CVE-2020-24512)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
4. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1788786 - CVE-2020-0548 hw: Vector Register Data Sampling
1788788 - CVE-2020-0549 hw: L1D Cache Eviction Sampling
1827165 - CVE-2020-0543 hw: Special Register Buffer Data Sampling (SRBDS)
1828583 - CVE-2020-8695 hw: Information disclosure issue in Intel SGX via RAPL interface
1890355 - CVE-2020-8696 hw: Vector Register Leakage-Active
1890356 - CVE-2020-8698 hw: Fast forward store predictor
1962650 - CVE-2020-24489 hw: vt-d related privilege escalation
1962702 - CVE-2020-24511 hw: improper isolation of shared resources in some Intel Processors
1962722 - CVE-2020-24512 hw: observable timing discrepancy in some Intel Processors
1972326 - [rhel-8.2.0.z] Re-enable 06-5e-03 (SKL-H/S, CPUID 0x506e3) latest microcode updates
1972329 - [rhel-8.2.0.z] Re-enable 06-8c-01 (TGL-UP3/UP4, CPUID 0x806c1) latest microcode updates
6. Package List:
Red Hat Enterprise Linux BaseOS EUS (v. 8.2):
Source:
microcode_ctl-20191115-4.20210608.1.el8_2.src.rpm
x86_64:
microcode_ctl-20191115-4.20210608.1.el8_2.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2020-0543
https://access.redhat.com/security/cve/CVE-2020-0548
https://access.redhat.com/security/cve/CVE-2020-0549
https://access.redhat.com/security/cve/CVE-2020-8695
https://access.redhat.com/security/cve/CVE-2020-8696
https://access.redhat.com/security/cve/CVE-2020-8698
https://access.redhat.com/security/cve/CVE-2020-24489
https://access.redhat.com/security/cve/CVE-2020-24511
https://access.redhat.com/security/cve/CVE-2020-24512
https://access.redhat.com/security/updates/classification/#important
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2021 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBYS3099zjgjWX9erEAQjjvw/+L3GJMIpGd1Qi2RD+heCBcNfI8T+oaLoO
Uq1f9UZovu64Ia/dk7lmSxORjM/49JCqQTjXFLTTNIcEvgGXpdigndVxwm9wes76
j5uBZrrn+yKIOtvyw3e32ZN8+Aya7WTko0NV/T8BLBR1JUoRQT6ioA0pwb9CaGvw
JgvitjTWrb+TsehDDl/l4r3Oi0z4C0s5n1/tAU4bPJq9RNwZkMTypYyKeh+Az21p
GjRWTokq7uWsEJteza5rGpZSLKLl4B1V0WSlrDMK+8xcSFf6Uv7UolmgbLt3AhZq
etnDiWzG3utg/x2AdbuhHByLSFRcf4CabrggYZjyzqFxY27bxuSGxGNiuN/Yd4W9
TQbRRJ5cZLeurg7n28WQBIKr0m4Uu394BLwq2+9hEQ0/KZ7uNWJcheaAvKc5Tl7l
0tsjbOzer/EoN737J9mrv4DkEotQ9FUjljmOdvkpoA38U/9dtuaTRoWFq5C8aRgp
VZCDUikablQtIr+zMFe4L57RnjWHFUpG6IGiazhpWWOAEHjWQ/hd/EjVZIrvVTz9
EP48+92zJgRQ+BJYoTA5i1DlfNwMW6c9vGLfHddTwz4PQDwTBmzAJeQ8OPVA4ql/
CHD+TcTTCjj5+Dlh8y7BbaGhrCO4309Ro60fnU1nz/BAoUiJXsdW+3qmBeg1PKnb
g+OnAHbRcOs=
=4lxm
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBYS7Cr+NLKJtyKPYoAQhAExAAltiNEKcjf2qLJEhq8AMxZ+xzYj2yYZJu
dew2MJKKB4Blz+rWvjRCKhPS3UWIegK/ue4R8DfDCYVK22DcayElL4tOhCjHeTkM
H4/eTyRRUET59w/K16f2CyqDw6FivAw3oR1/mftfjcWSwCHVQAamrtGxKfOHrhc6
cRvTnllNfme3sHqwe/trT/2hfLgTvY1XNRpyeakRv2u+F8b63vSlB6p5bLcPgcxQ
9EO4uYhB9bg7HyBu/EUu2GtNB4la9ExlyitwxmE6aFxOUfkVmmWMOziuWiDM82tj
rVl9AV40wDUdFifUJt3loGL8OfLz3TAaR/xzcxY5kvwMe7U/dDyXsIRGdz6ABdwB
Wmd3qn2Mjthz7cJjngr/S4BgJ21iaGBVtd40lPhQg1rA9GDUWyUS8t164yA1KyQN
WQpqJWejJv2FnzHCFVJY31ode3BTbMvV7Ednhy6TzofU3xTgDyWeLpZ45NF8bwKu
TjDAhrymKZ2RKOkpif1ijOYI17jw1m7p4blOUBwlZPHdwTYVJIaMLdrEEgJCbmV3
Z7hDF2Po3S10NLpODUAzZiW4y1KPUVJEF0pvLJlKgxn55SR0MghDac7DVVvwBk+l
jRdeD8j0xw7HN2mEoj5wpF+WLX/b52QeFgdVs6dNufFrUyUbLRcV1d+xLKUPkWGU
F7Wq/ROFMe0=
=PVx6
-----END PGP SIGNATURE-----