INFCSA-2024:9401: microcode_ctl security update
Information about definition
Identificator: INFCSA-2024:9401
Type: security
Release date: 2025-09-24 19:39:09 UTC
Information about package
The microcode_ctl packages provide microcode updates for Intel and AMD processors.
Vulnerabilities description
- CVE-2023-22655
Protection mechanism failure in some 3rd and 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege via local access.
- CVE-2023-28746
A vulnerability was found in some Intel Atom Processor's microcode. This issue may allow a malicious actor to achieve a local information disclosure, impacting the data confidentiality of the targeted system.
- CVE-2023-38575
Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.
- CVE-2023-39368
Protection mechanism failure of bus lock regulator for some Intel(R) Processors may allow an unauthenticated user to potentially enable denial of service via network access.
- CVE-2023-43490
Incorrect calculation in microcode keying mechanism for some Intel(R) Xeon(R) D Processors with Intel(R) SGX may allow a privileged user to potentially enable information disclosure via local access.
- CVE-2023-45733
Hardware logic contains race conditions in some Intel(R) Processors may allow an authenticated user to potentially enable partial information disclosure via local access.
- CVE-2023-46103
Sequence of processor instructions leads to unexpected behavior in Intel(R) Core(TM) Ultra Processors may allow an authenticated user to potentially enable denial of service via local access.
Severity level
CVE | Score CVSS 2.0 | Score CVSS 3.x | Score CVSS 4.0 |
---|---|---|---|
NIST — CVE-2023-22655
|
no information | 6.1 | no information |
NIST — CVE-2023-28746
|
no information | 6.5 | no information |
NIST — CVE-2023-38575
|
no information | 5.5 | no information |
NIST — CVE-2023-39368
|
no information | 6.5 | no information |
NIST — CVE-2023-43490
|
no information | 5.3 | no information |
NIST — CVE-2023-45733
|
no information | 2.8 | no information |
NIST — CVE-2023-46103
|
no information | 4.7 | no information |
Updated packages