Information disclosure in Intel products - CVE-2020-24513

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU54220

Information disclosure in Intel products - CVE-2020-24513

Published: June 18, 2021


Vulnerability identifier: #VU54220
CSH Severity: Low
CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-24513
CWE-ID: CWE-200
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user o gain access to potentially sensitive information.

The vulnerability exists due to domain-bypass transient execution issue. A local user can gain unauthorized access to sensitive information on the system.


Affected software

Intel Atom Processor E3900 Series
Intel Xeon Scalable Processors
Intel Pentium Processor J Series
Intel Pentium Processor N Series
Dell EMC Unity Operating Environment (OE)
Dell EMC Unity VSA Operating Environment (OE)
Dell EMC Unity XT Operating Environment (OE)
Intel Atom Processor C Series
6th Generation Intel Core Processors
Intel Xeon D Processors
Intel Xeon W Processors
2nd Generation Intel Xeon Scalable Processors
Intel Core X-series Processor
3rd Generation Intel Xeon Scalable Processors
Intel Atom Processor A Series
Intel Atom Processor X Series
Intel Puma 7 Family
Intel Atom Processors
Intel Pentium Processor Silver Series
10th Generation Intel Core Processors
Intel Core Processors with Intel Hybrid Technology
8th Generation Intel Core Processors
7th Generation Intel Core Processors
Legacy Intel Pentium Processors
Intel Xeon E Processors
Intel Core X-series Processors
Intel Atom Processor Z Series
Intel Celeron Processor J Series
Intel Celeron Processor N Series
Intel Atom Processor E3800 Product Family
Legacy Intel Core Processors
Legacy Intel Celeron Processors
3rd Generation Intel Core Processors
Intel Pentium Processors
Intel Celeron Processors
5th Generation Intel Core Processor Family
4th Generation Intel Core Processor Family
1st Generation Intel Core Processor Family
2nd Generation Intel Core Processor Family
SIMATIC IPC527GE
SIMATIC IPC477E Pro
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
SIMATIC S7-1500 CPU 1518F-4 PN-DP MFP
SINUMERIK 828D HW PPU.4
SINUMERIK MC MCU 1720
SINUMERIK ONE / SINUMERIK 840D sl Handheld Terminal HT 10
SINUMERIK ONE PPU 1740
SIMATIC IPC127E
SIMATIC Drive Controller
SIMATIC Field PG M5
SIMATIC Field PG M6
SIMATIC IPC677E
SIMATIC IPC847E
SIMATIC IPC647E
SIMATIC IPC627E
Arch Linux
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE MicroOS
SUSE Enterprise Storage
Red Hat Enterprise Linux Server - Extended Life Cycle Support
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux EUS Compute Node
Anolis OS
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
HPE Helion Openstack
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise Point of Sale
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
Ubuntu
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
openEuler
SIMATIC IPC547G
SIMATIC ITP1000
SIMATIC IPC477E
SIMATIC IPC427E
SIMATIC ET 200SP Open Controller CPU 1515SP PC2
microcode_ctl (Red Hat package)
intel-microcode (Debian package)
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
microcode_ctl
intel-microcode (Ubuntu package)
ucode-intel-debugsource
ucode-intel-debuginfo
ucode-intel

How to mitigate CVE-2020-24513

Install updates from vendor's website.

microcode_ctl (Red Hat package) - addressed in versions 1.17-33.33.el6_10, 2.1-12.37.el7_2, 2.1-16.40.el7_3, 2.1-22.39.el7_4, 2.1-47.21.el7_6, 2.1-53.16.el7_7, 2.1-73.9.el7_9, 20190618-1.20210525.1.el8_1, 20191115-4.20210525.1.el8_2, 20210216-1.20210525.1.el8_4
intel-microcode (Debian package) - update to 3.20210608.2~deb10u1
microcode_ctl - update to 1.17-102.83.71.1
microcode_ctl - update to 2.1-36
intel-microcode (Ubuntu package) - addressed in versions 3.20210608.0ubuntu0.18.04.1, 3.20210608.0ubuntu0.20.04.1, 3.20210608.0ubuntu0.20.10.1, 3.20210608.0ubuntu0.21.04.1
Dell EMC Unity Operating Environment (OE) - update to 5.2.0.0.5.173
Dell EMC Unity VSA Operating Environment (OE) - update to 5.2.0.0.5.173
Dell EMC Unity XT Operating Environment (OE) - update to 5.2.0.0.5.173
SIMATIC IPC677E - update to 25.02.10
SIMATIC IPC847E - update to 25.02.10
SIMATIC IPC647E - update to 25.02.10
SIMATIC IPC627E - update to 25.02.10
microcode_ctl - addressed in versions 20191115-4.20210608.1, 20210216-1.20210525.1
ucode-intel-debugsource - addressed in versions 20210525-3.35.1, 20210525-13.90.1
ucode-intel-debuginfo - addressed in versions 20210525-3.35.1, 20210525-13.90.1
ucode-intel - addressed in versions 20210525-3.35.1, 20210525-3.67.1, 20210525-3.203.1, 20210525-7.1, 20210525-13.90.1

External References

Related Security Bulletins