INFCSA-2024:9401: microcode_ctl security update
Information about definition
Identificator: INFCSA-2024:9401
Type: security
Release date: 2025-09-24 19:39:09 UTC
Information about package
The microcode_ctl packages provide microcode updates for Intel and AMD processors.
Vulnerabilities description
- CVE-2023-22655
Protection mechanism failure in some 3rd and 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege via local access.
- CVE-2023-28746
A vulnerability was found in some Intel Atom Processor's microcode. This issue may allow a malicious actor to achieve a local information disclosure, impacting the data confidentiality of the targeted system.
- CVE-2023-38575
Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.
- CVE-2023-39368
Protection mechanism failure of bus lock regulator for some Intel(R) Processors may allow an unauthenticated user to potentially enable denial of service via network access.
- CVE-2023-43490
Incorrect calculation in microcode keying mechanism for some Intel(R) Xeon(R) D Processors with Intel(R) SGX may allow a privileged user to potentially enable information disclosure via local access.
- CVE-2023-45733
Hardware logic contains race conditions in some Intel(R) Processors may allow an authenticated user to potentially enable partial information disclosure via local access.
- CVE-2023-46103
Sequence of processor instructions leads to unexpected behavior in Intel(R) Core(TM) Ultra Processors may allow an authenticated user to potentially enable denial of service via local access.
Severity level
| CVE | Score CVSS 2.0 | Score CVSS 3.x | Score CVSS 4.0 |
|---|---|---|---|
|
NIST — CVE-2023-22655
|
no information | 6.1 | no information |
|
NIST — CVE-2023-28746
|
no information | 6.5 | no information |
|
NIST — CVE-2023-38575
|
no information | 5.5 | no information |
|
NIST — CVE-2023-39368
|
no information | 6.5 | no information |
|
NIST — CVE-2023-43490
|
no information | 5.3 | no information |
|
NIST — CVE-2023-45733
|
no information | 2.8 | no information |
|
NIST — CVE-2023-46103
|
no information | 4.7 | no information |
Updated packages