Incomplete cleanup in Intel products - CVE-2020-24489

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU54191

Incomplete cleanup in Intel products - CVE-2020-24489

Published: June 17, 2021 / Updated: June 21, 2021


Vulnerability identifier: #VU54191
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-24489
CWE-ID: CWE-459
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incomplete cleanup, which leads to security restrictions bypass and privilege escalation.


Affected software

10th Generation Intel Core Processors
11th Generation Intel Core Processors
Intel Pentium Processor N Series Intel Celeron Processor J Series
Intel Celeron Processor N Series Intel Atom Processor
Intel Celeron Processor N Series
Intel Pentium Processor Silver Series
Intel Core Processors with Intel Hybrid Technology
Intel Pentium Processor J Series
Intel Atom Processor E3900 Series
Intel Pentium Processor N Series
Dell EMC Unity VSA Operating Environment (OE)
Dell EMC Unity XT Operating Environment (OE)
Dell EMC Unity Operating Environment (OE)
Arch Linux
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE CaaS Platform
SUSE Manager Server
SUSE MicroOS
Red Hat Enterprise Linux Server - Extended Life Cycle Support
SUSE Enterprise Storage
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Anolis OS
HPE Helion Openstack
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise Point of Sale
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
Ubuntu
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
openEuler
microcode_ctl (Red Hat package)
intel-microcode (Debian package)
redhat-release-virtualization-host (Red Hat package)
redhat-virtualization-host (Red Hat package)
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
microcode_ctl
intel-microcode (Ubuntu package)
ucode-intel-debugsource
ucode-intel-debuginfo
ucode-intel
Red Hat Virtualization
Red Hat Virtualization Host

How to mitigate CVE-2020-24489

Install updates from vendor's website.

microcode_ctl (Red Hat package) - addressed in versions 1.17-33.33.el6_10, 2.1-12.37.el7_2, 2.1-12.39.el7_2, 2.1-16.40.el7_3, 2.1-16.42.el7_3, 2.1-22.39.el7_4, 2.1-22.41.el7_4, 2.1-47.21.el7_6, 2.1-47.23.el7_6, 2.1-53.16.el7_7, 2.1-53.18.el7_7, 2.1-73.9.el7_9, 2.1-73.11.el7_9, 20190618-1.20210525.1.el8_1, 20190618-1.20210608.1.el8_1, 20191115-4.20210525.1.el8_2, 20191115-4.20210608.1.el8_2, 20210216-1.20210525.1.el8_4, 20210216-1.20210608.1.el8_4
intel-microcode (Debian package) - update to 3.20210608.2~deb10u1
redhat-release-virtualization-host (Red Hat package) - addressed in versions 4.3.16-1.el7ev, 4.4.6-2.el8ev
redhat-virtualization-host (Red Hat package) - addressed in versions 4.3.16-20210615.0.el7_9, 4.4.6-20210615.0.el8_4
microcode_ctl - update to 1.17-102.83.71.1
microcode_ctl - update to 2.1-36
intel-microcode (Ubuntu package) - addressed in versions 3.20210608.0ubuntu0.18.04.1, 3.20210608.0ubuntu0.20.04.1, 3.20210608.0ubuntu0.20.10.1, 3.20210608.0ubuntu0.21.04.1
Dell EMC Unity VSA Operating Environment (OE) - update to 5.2.0.0.5.173
Dell EMC Unity XT Operating Environment (OE) - update to 5.2.0.0.5.173
Dell EMC Unity Operating Environment (OE) - update to 5.2.0.0.5.173
microcode_ctl - addressed in versions 20191115-4.20210608.1, 20210216-1.20210525.1, 20210216-1.20210608.1
ucode-intel-debugsource - addressed in versions 20210525-3.35.1, 20210525-13.90.1
ucode-intel-debuginfo - addressed in versions 20210525-3.35.1, 20210525-13.90.1
ucode-intel - addressed in versions 20210525-3.35.1, 20210525-3.67.1, 20210525-3.203.1, 20210525-7.1, 20210525-13.90.1

External References

Related Security Bulletins