exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Ubuntu Security Notice USN-6797-1

Ubuntu Security Notice USN-6797-1
Posted May 29, 2024
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 6797-1 - It was discovered that some 3rd and 4th Generation Intel® Xeon® Processors did not properly restrict access to certain hardware features when using Intel® SGX or Intel® TDX. This may allow a privileged local user to potentially further escalate their privileges on the system. This issue only affected Ubuntu 23.10, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04 LTS and Ubuntu 16.04 LTS. It was discovered that some Intel® Atom® Processors did not properly clear register state when performing various operations. A local attacker could use this to obtain sensitive information via a transient execution attack. This issue only affected Ubuntu 23.10, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04 LTS and Ubuntu 16.04 LTS.

tags | advisory, local
systems | linux, ubuntu
advisories | CVE-2023-22655, CVE-2023-28746, CVE-2023-38575, CVE-2023-39368, CVE-2023-43490, CVE-2023-45733, CVE-2023-46103, CVE-2023-47855
SHA-256 | 1ae00687dcd8bf9e9f41102f5446e293b7f0e18dbc2d69d9941f2b35474397b5

Ubuntu Security Notice USN-6797-1

Change Mirror Download
==========================================================================
Ubuntu Security Notice USN-6797-1
May 29, 2024

intel-microcode vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS
- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in Intel Microcode.

Software Description:
- intel-microcode: Processor microcode for Intel CPUs

Details:

It was discovered that some 3rd and 4th Generation Intel® Xeon® Processors
did not properly restrict access to certain hardware features when using
Intel® SGX or Intel® TDX. This may allow a privileged local user to
potentially further escalate their privileges on the system. This issue only
affected Ubuntu 23.10, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04 LTS and
Ubuntu 16.04 LTS. (CVE-2023-22655)

It was discovered that some Intel® Atom® Processors did not properly clear
register state when performing various operations. A local attacker could
use this to obtain sensitive information via a transient execution attack.
This issue only affected Ubuntu 23.10, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS,
Ubuntu 18.04 LTS and Ubuntu 16.04 LTS. (CVE-2023-28746)

It was discovered that some Intel® Processors did not properly clear the
state of various hardware structures when switching execution contexts. A
local attacker could use this to access privileged information. This issue only
affected Ubuntu 23.10, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04 LTS and
Ubuntu 16.04 LTS. (CVE-2023-38575)

It was discovered that some Intel® Processors did not properly enforce bus
lock regulator protections. A remote attacker could use this to cause a
denial of service. This issue only affected Ubuntu 23.10, Ubuntu 22.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 18.04 LTS and Ubuntu 16.04 LTS. (CVE-2023-39368)

It was discovered that some Intel® Xeon® D Processors did not properly
calculate the SGX base key when using Intel® SGX. A privileged local
attacker could use this to obtain sensitive information. This issue only
affected Ubuntu 23.10, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04 LTS and
Ubuntu 16.04 LTS. (CVE-2023-43490)

It was discovered that some Intel® Processors did not properly protect against
concurrent accesses. A local attacker could use this to obtain sensitive
information. (CVE-2023-45733)

It was discovered that some Intel® Processors TDX module software did not
properly validate input. A privileged local attacker could use this information
to potentially further escalate their privileges on the system.
(CVE-2023-45745, CVE-2023-47855)

It was discovered that some Intel® Core™ Ultra processors did not properly
handle particular instruction sequences. A local attacker could use this
issue to cause a denial of service. (CVE-2023-46103)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
intel-microcode 3.20240514.0ubuntu0.24.04.1

Ubuntu 23.10
intel-microcode 3.20240514.0ubuntu0.23.10.1

Ubuntu 22.04 LTS
intel-microcode 3.20240514.0ubuntu0.22.04.1

Ubuntu 20.04 LTS
intel-microcode 3.20240514.0ubuntu0.20.04.1

Ubuntu 18.04 LTS
intel-microcode 3.20240514.0ubuntu0.18.04.1+esm1
Available with Ubuntu Pro

Ubuntu 16.04 LTS
intel-microcode 3.20240514.0ubuntu0.16.04.1+esm1
Available with Ubuntu Pro

After a standard system update you need to reboot your computer to make
all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6797-1
CVE-2023-22655, CVE-2023-28746, CVE-2023-38575, CVE-2023-39368,
CVE-2023-43490, CVE-2023-45733, CVE-2023-45745, CVE-2023-46103,
CVE-2023-47855

Package Information:
https://launchpad.net/ubuntu/+source/intel-microcode/3.20240514.0ubuntu0.24.04.1
https://launchpad.net/ubuntu/+source/intel-microcode/3.20240514.0ubuntu0.23.10.1
https://launchpad.net/ubuntu/+source/intel-microcode/3.20240514.0ubuntu0.22.04.1
https://launchpad.net/ubuntu/+source/intel-microcode/3.20240514.0ubuntu0.20.04.1


--
Alex Murray
Staff Engineer | Security Engineering
Adelaide, Australia (GMT+0930)
Login or Register to add favorites

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    28 Files
  • 16
    Jul 16th
    6 Files
  • 17
    Jul 17th
    34 Files
  • 18
    Jul 18th
    6 Files
  • 19
    Jul 19th
    34 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    19 Files
  • 23
    Jul 23rd
    17 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close