Observable discrepancy in Intel products - CVE-2020-24512

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU54204

Observable discrepancy in Intel products - CVE-2020-24512

Published: June 17, 2021


Vulnerability identifier: #VU54204
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-24512
CWE-ID: CWE-203
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to observable timing discrepancy. A local user can gain unauthorized access to sensitive information on the system.


Affected software

10th Generation Intel Core Processors
Intel Xeon D Processors
Intel Xeon W Processors
2nd Generation Intel Xeon Scalable Processors
Intel Core X-series Processor
3rd Generation Intel Xeon Scalable Processors
Intel Atom Processor A Series
Intel Puma 7 Family
Intel Pentium Processor Silver Series
6th Generation Intel Core Processors
Intel Core Processors with Intel Hybrid Technology
11th Generation Intel Core Processors
8th Generation Intel Core Processors
7th Generation Intel Core Processors
Intel Pentium Gold Processor Series
Intel Celeron Processor 5000 Series
Intel Celeron Processor G Series
3rd Generation Intel Core Processors
Intel Xeon E Processors
Intel Core X-series Processors
Intel Atom Processor Z Series
Intel Celeron Processor J Series
Intel Celeron Processor N Series
Intel Atom Processor E3800 Product Family
Legacy Intel Pentium Processors
Legacy Intel Celeron Processors
Legacy Intel Core Processors
Intel Pentium Processors
Intel Celeron Processors
4th Generation Intel Core Processor Family
1th Generation Intel Core Processor Family
2nd Generation Intel Core Processor Family
3rd Intel Xeon E processor family
5th Generation Intel Core Processor Family
Intel Atom Processors
Intel Atom Processor X Series
Intel Atom Processor C Series
SIMATIC Drive Controller
SINUMERIK ONE PPU 1740
SINUMERIK ONE / SINUMERIK 840D sl Handheld Terminal HT 10
SINUMERIK 828D HW PPU.4
SIMATIC S7-1500 CPU 1518F-4 PN-DP MFP
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
SINUMERIK MC MCU 1720
SIMATIC Field PG M5
SIMATIC Field PG M6
SIMATIC IPC127E
SIMATIC IPC477E Pro
SIMATIC IPC527GE
SIMATIC IPC627E
SIMATIC IPC847E
SIMATIC IPC647E
SIMATIC IPC677E
Intel Xeon Scalable Processors
Intel Atom Processor E3900 Series
Intel Pentium Processor J Series
Intel Pentium Processor N Series
Dell EMC Unity Operating Environment (OE)
Dell EMC Unity XT Operating Environment (OE)
Dell EMC Unity VSA Operating Environment (OE)
9th Generation Intel Core Processors
Arch Linux
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE MicroOS
SUSE Enterprise Storage
Red Hat Enterprise Linux Server - Extended Life Cycle Support
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
CentOS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Anolis OS
HPE Helion Openstack
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise Point of Sale
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
Ubuntu
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
openEuler
SIMATIC ITP1000
SIMATIC IPC547G
SIMATIC ET 200SP Open Controller CPU 1515SP PC2
SIMATIC IPC427E
SIMATIC IPC477E
microcode_ctl (Red Hat package)
intel-microcode (Debian package)
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
microcode_ctl
intel-microcode (Ubuntu package)
ucode-intel-debugsource
ucode-intel-debuginfo
ucode-intel
Edgeline EL300 Converged Edge System
Dell EMC VxRail Appliance

How to mitigate CVE-2020-24512

Install updates from vendor's website.

microcode_ctl (Red Hat package) - addressed in versions 1.17-33.33.el6_10, 2.1-12.37.el7_2, 2.1-12.39.el7_2, 2.1-16.40.el7_3, 2.1-16.42.el7_3, 2.1-22.39.el7_4, 2.1-22.41.el7_4, 2.1-47.21.el7_6, 2.1-47.23.el7_6, 2.1-53.16.el7_7, 2.1-53.18.el7_7, 2.1-73.9.el7_9, 2.1-73.11.el7_9, 20190618-1.20210525.1.el8_1, 20190618-1.20210608.1.el8_1, 20191115-4.20210525.1.el8_2, 20191115-4.20210608.1.el8_2, 20210216-1.20210525.1.el8_4, 20210216-1.20210608.1.el8_4
intel-microcode (Debian package) - update to 3.20210608.2~deb10u1
Edgeline EL300 Converged Edge System - addressed in versions EL01_1.40, 11.8.86.3909
microcode_ctl - update to 1.17-102.83.71.1
microcode_ctl - update to 2.1-33
intel-microcode (Ubuntu package) - addressed in versions 3.20210608.0ubuntu0.18.04.1, 3.20210608.0ubuntu0.20.04.1, 3.20210608.0ubuntu0.20.10.1, 3.20210608.0ubuntu0.21.04.1
Dell EMC Unity Operating Environment (OE) - update to 5.2.0.0.5.173
Dell EMC Unity XT Operating Environment (OE) - update to 5.2.0.0.5.173
Dell EMC Unity VSA Operating Environment (OE) - update to 5.2.0.0.5.173
Dell EMC VxRail Appliance - update to 7.0.300
SIMATIC IPC627E - update to 25.02.10
SIMATIC IPC847E - update to 25.02.10
SIMATIC IPC647E - update to 25.02.10
SIMATIC IPC677E - update to 25.02.10
microcode_ctl - addressed in versions 20191115-4.20210608.1, 20210216-1.20210525.1, 20210216-1.20210608.1
ucode-intel-debugsource - addressed in versions 20210525-3.35.1, 20210525-13.90.1
ucode-intel-debuginfo - addressed in versions 20210525-3.35.1, 20210525-13.90.1
ucode-intel - addressed in versions 20210525-3.35.1, 20210525-3.67.1, 20210525-3.203.1, 20210525-7.1, 20210525-13.90.1

External References

Related Security Bulletins