Improper access control in Intel products - CVE-2024-36293

Vulnerability identifier: #VU104108

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-36293

CWE-ID: CWE-284

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in the EDECCSSA user leaf function. A local user can bypass implemented security restrictions and perform a denial of service (DoS) attack.

Software Guard Extensions (SGX)
3rd Generation Intel Xeon Scalable Processors
11th Generation Intel Core Processors
Intel Xeon E-2300 processor family
Intel Xeon D Processors
8th Generation Intel Core Processors
Intel Xeon E Processors
4th Generation Intel Xeon Scalable Processors
4th Generation Intel Xeon Platinum processors
4th Generation Intel Xeon Gold Processors
4th Generation Intel Xeon Silver Processors
4th Generation Intel Xeon Bronze Processors
Intel Xeon CPU Max Series processors
PowerEdge MX760c
PowerEdge R860
PowerEdge R960
PowerEdge HS5610
PowerEdge HS5620
PowerEdge C6620
PowerEdge R760
PowerEdge R660
PowerEdge R660xs
PowerEdge R760xs
PowerEdge R760xd2
PowerEdge T560
Dell XC Core XC760xa
Dell XC Core XC660xs
Dell XC Core XC760
Dell XC Core XC660
PowerEdge XE9640
PowerEdge XE8640
PowerEdge XR7620
PowerEdge XR8620t
PowerEdge XR8610t
PowerEdge XR5610
PowerEdge XE9680
PowerEdge R760xa
PowerEdge R350
PowerEdge R250
PowerEdge T350
PowerEdge T150
PowerEdge R650
PowerEdge R450
PowerEdge R650XS
PowerEdge R550
PowerEdge MX750c
PowerEdge R750XS
PowerEdge T550
PowerEdge C6520
PowerEdge R750XA
PowerEdge XR11
PowerEdge XR12
PowerEdge R750
Dell EMC XC Core XC450
Dell EMC XC Core XC650
Dell EMC XC Core XC750
Dell EMC XC Core XC750xa
Dell EMC XC Core XC6520
PowerEdge XR4510c
PowerEdge XR4520c
OptiPlex 5070
OptiPlex 3070
OptiPlex 7090 Tower
Precision 3450
Inspiron 3891
Dell Precision 3431 Tower
Vostro 5890
Vostro 3890
Vostro 3690
Precision 5540
XPS 15 7590
OptiPlex 5270 All-In-One
OptiPlex 7470 All-In-One
OptiPlex 7770 All-In-One
Latitude 5401
Latitude 5501
OptiPlex 5490 All-In-One
OptiPlex 7490 All-in-One
Precision 3541
Precision 7740
Precision 3650 Tower
Precision 7540
Precision 7730
Precision 5860 Tower
Precision 7960 Tower
PowerEdge R240
PowerEdge R340
Dell EMC NX440
PowerEdge T140
PowerEdge T340
XPS 8940
Precision 3930 Rack
9th Generation Intel Core Processors
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
SUSE Enterprise Storage
Basesystem Module
openSUSE Leap
Ubuntu
openEuler
Fedora
intel-microcode (Ubuntu package)
microcode_ctl
ucode-intel-debuginfo
ucode-intel
ucode-intel-debugsource
OptiPlex 7071
OptiPlex 7070
PowerProtect Data Manager
Dell Integrated System for Microsoft Azure Stack Hub 16G

Install updates from vendor's website.

intel-microcode (Ubuntu package) - addressed in versions Ubuntu Pro, 3.20250211.0ubuntu0.20.04.1, 3.20250211.0ubuntu0.22.04.1, 3.20250211.0ubuntu0.24.04.1, 3.20250211.0ubuntu0.24.10.1
PowerEdge R350 - update to 1.11.1
PowerEdge R250 - update to 1.11.1
PowerEdge T350 - update to 1.11.1
PowerEdge T150 - update to 1.11.1
PowerEdge R650 - update to 1.16.2
PowerEdge R450 - update to 1.16.2
PowerEdge R650XS - update to 1.16.2
PowerEdge R550 - update to 1.16.2
PowerEdge MX750c - update to 1.16.2
PowerEdge R750XS - update to 1.16.2
PowerEdge T550 - update to 1.16.2
PowerEdge C6520 - update to 1.16.2
PowerEdge R750XA - update to 1.16.2
PowerEdge XR11 - update to 1.16.2
PowerEdge XR12 - update to 1.16.2
PowerEdge R750 - update to 1.16.2
Dell EMC XC Core XC450 - update to 1.16.2
Dell EMC XC Core XC650 - update to 1.16.2
Dell EMC XC Core XC750 - update to 1.16.2
Dell EMC XC Core XC750xa - update to 1.16.2
Dell EMC XC Core XC6520 - update to 1.16.2
PowerEdge XR4510c - update to 1.17.3
PowerEdge XR4520c - update to 1.17.3
OptiPlex 7071 - update to 1.30.0
OptiPlex 5070 - update to 1.30.1
OptiPlex 7070 - update to 1.30.1
OptiPlex 3070 - update to 1.30.1
OptiPlex 7090 Tower - update to 1.31.0
Precision 3450 - update to 1.31.0
Inspiron 3891 - update to 1.31.0
Dell Precision 3431 Tower - update to 1.31.0
Vostro 5890 - update to 1.31.0
Vostro 3890 - update to 1.31.0
Vostro 3690 - update to 1.31.0
Precision 5540 - update to 1.33.0
XPS 15 7590 - update to 1.33.0
OptiPlex 5270 All-In-One - update to 1.33.1
OptiPlex 7470 All-In-One - update to 1.33.1
OptiPlex 7770 All-In-One - update to 1.33.1
Latitude 5401 - update to 1.36.0
Latitude 5501 - update to 1.36.0
OptiPlex 5490 All-In-One - update to 1.36.0
OptiPlex 7490 All-in-One - update to 1.36.0
Precision 3541 - update to 1.36.0
Precision 7740 - update to 1.37.0
Precision 3650 Tower - update to 1.37.0
Precision 7540 - update to 1.37.0
Precision 7730 - update to 1.38.0
microcode_ctl - addressed in versions 2.1-61.6.fc40, 2.1-67.1.fc41
Precision 5860 Tower - update to 2.6.1
Precision 7960 Tower - update to 2.6.1
PowerEdge R240 - update to 2.18.0
PowerEdge R340 - update to 2.18.0
Dell EMC NX440 - update to 2.18.0
PowerEdge T140 - update to 2.18.0
PowerEdge T340 - update to 2.18.0
XPS 8940 - update to 2.25.0
Precision 3930 Rack - update to 2.34.0
PowerProtect Data Manager - update to 19.19.0-15
Dell Integrated System for Microsoft Azure Stack Hub 16G - update to 2502
microcode_ctl - update to 20250211-1
ucode-intel-debuginfo - update to 20250211-149.2
ucode-intel - addressed in versions 20250211-149.2, 20250211-150200.53.1
ucode-intel-debugsource - update to 20250211-149.2

• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01213.html
• https://www.dell.com/support/kbdoc/en-us/000283897/dsa-2025-041-security-update-for-dell-poweredge-server-for-intel-2025-security-advisories-2025-1-ipu

• Denial of service in Intel SGX
• Ubuntu update for intel-microcode
• Ubuntu update for intel-microcode
• Fedora 40 update for microcode_ctl
• Fedora 41 update for microcode_ctl
• openEuler update for microcode_ctl
• SUSE update for ucode-intel
• SUSE update for ucode-intel
• Multiple vulnerabilities in Dell PowerProtect Data Manager
• Multiple vulnerabilities in Dell Client Platform
• Multiple vulnerabilities in Dell PowerEdge Server
• Multiple vulnerabilities in Dell Integrated System