drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in ucode-intel
Name: |
Mehrere Probleme in ucode-intel |
|
ID: |
SUSE-SU-2024:0917-1 |
|
Distribution: |
SUSE |
|
Plattformen: |
SUSE Linux Enterprise Server 12 SP5, SUSE Linux Enterprise High Performance Computing 12 SP5, SUSE Linux Enterprise Server for SAP Applications 12 SP5 |
|
Datum: |
Fr, 22. März 2024, 18:57 |
|
Referenzen: |
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28746
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38575
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-43490
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22655
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39368 |
|
Applikationen: |
intel-microcode |
|
Originalnachricht |
--===============6878938333988253021== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit
# Security update for ucode-intel
Announcement ID: SUSE-SU-2024:0917-1 Rating: moderate References:
* bsc#1221323
Cross-References:
* CVE-2023-22655 * CVE-2023-28746 * CVE-2023-38575 * CVE-2023-39368 * CVE-2023-43490
CVSS scores:
* CVE-2023-22655 ( SUSE ): 6.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N * CVE-2023-28746 ( SUSE ): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N * CVE-2023-38575 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N * CVE-2023-39368 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2023-43490 ( SUSE ): 5.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
Affected Products:
* SUSE Linux Enterprise High Performance Computing 12 SP5 * SUSE Linux Enterprise Server 12 SP5 * SUSE Linux Enterprise Server for SAP Applications 12 SP5
An update that solves five vulnerabilities can now be installed.
## Description:
This update for ucode-intel fixes the following issues:
* Updated to Intel CPU Microcode 20240312 release. (bsc#1221323) * CVE-2023-39368: Protection mechanism failure of bus lock regulator for some Intel Processors may allow an unauthenticated user to potentially enable denial of service via network access * CVE-2023-38575: Non-transparent sharing of return predictor targets between contexts in some Intel Processors may allow an authorized user to potentially enable information disclosure via local access. * CVE-2023-28746: Information exposure through microarchitectural state after transient execution from some register files for some Intel Atom Processors may allow an authenticated user to potentially enable information disclosure via local access. * CVE-2023-22655 Protection mechanism failure in some 3rd and 4th Generation Intel Xeon Processors when using Intel SGX or Intel TDX may allow a privileged user to potentially enable escalation of privilege via local access. * CVE-2023-43490: Incorrect calculation in microcode keying mechanism for some Intel Xeon D Processors with Intel® SGX may allow a privileged user to potentially enable information disclosure via local access.
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product:
* SUSE Linux Enterprise Server for SAP Applications 12 SP5 zypper in -t patch SUSE-SLE-SERVER-12-SP5-2024-917=1
* SUSE Linux Enterprise High Performance Computing 12 SP5 zypper in -t patch SUSE-SLE-SERVER-12-SP5-2024-917=1
* SUSE Linux Enterprise Server 12 SP5 zypper in -t patch SUSE-SLE-SERVER-12-SP5-2024-917=1
## Package List:
* SUSE Linux Enterprise Server for SAP Applications 12 SP5 (x86_64) * ucode-intel-debuginfo-20240312-134.1 * ucode-intel-debugsource-20240312-134.1 * ucode-intel-20240312-134.1 * SUSE Linux Enterprise High Performance Computing 12 SP5 (x86_64) * ucode-intel-debuginfo-20240312-134.1 * ucode-intel-debugsource-20240312-134.1 * ucode-intel-20240312-134.1 * SUSE Linux Enterprise Server 12 SP5 (x86_64) * ucode-intel-debuginfo-20240312-134.1 * ucode-intel-debugsource-20240312-134.1 * ucode-intel-20240312-134.1
## References:
* https://www.suse.com/security/cve/CVE-2023-22655.html * https://www.suse.com/security/cve/CVE-2023-28746.html * https://www.suse.com/security/cve/CVE-2023-38575.html * https://www.suse.com/security/cve/CVE-2023-39368.html * https://www.suse.com/security/cve/CVE-2023-43490.html * https://bugzilla.suse.com/show_bug.cgi?id=1221323
--===============6878938333988253021== Content-Type: text/html; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit
<div class="container"> <h1>Security update for ucode-intel</h1>
<table class="table table-striped table-bordered"> <tbody> <tr> <th>Announcement ID:</th> <td>SUSE-SU-2024:0917-1</td> </tr> <tr> <th>Rating:</th> <td>moderate</td> </tr> <tr> <th>References:</th> <td> <ul> <li style="display: inline;"> <a href="https://bugzilla.suse.com/show_bug.cgi?id=1221323">bsc#1221323</a> </li> </ul> </td> </tr> <tr> <th> Cross-References: </th> <td> <ul> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2023-22655.html">CVE-2023-22655</a> </li> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2023-28746.html">CVE-2023-28746</a> </li> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2023-38575.html">CVE-2023-38575</a> </li> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2023-39368.html">CVE-2023-39368</a> </li> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2023-43490.html">CVE-2023-43490</a> </li> </ul> </td> </tr> <tr> <th>CVSS scores:</th> <td> <ul class="list-group"> <li class="list-group-item"> <span class="cvss-reference">CVE-2023-22655</span> <span class="cvss-source"> ( SUSE ): </span> <span class="cvss-score">6.1</span> <span class="cvss-vector">CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2023-28746</span> <span class="cvss-source"> ( SUSE ): </span> <span class="cvss-score">6.5</span> <span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2023-38575</span> <span class="cvss-source"> ( SUSE ): </span> <span class="cvss-score">5.5</span> <span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2023-39368</span> <span class="cvss-source"> ( SUSE ): </span> <span class="cvss-score">6.5</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2023-43490</span> <span class="cvss-source"> ( SUSE ): </span> <span class="cvss-score">5.3</span> <span class="cvss-vector">CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N</span> </li> </ul> </td> </tr> <tr> <th>Affected Products:</th> <td> <ul class="list-group"> <li class="list-group-item">SUSE Linux Enterprise High Performance Computing 12 SP5</li> <li class="list-group-item">SUSE Linux Enterprise Server 12 SP5</li> <li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 12 SP5</li> </ul> </td> </tr> </tbody> </table>
<p>An update that solves five vulnerabilities can now be installed.</p>
<h2>Description:</h2> <p>This update for ucode-intel fixes the following issues:</p> <ul> <li>Updated to Intel CPU Microcode 20240312 release. (bsc#1221323)</li> <li>CVE-2023-39368: Protection mechanism failure of bus lock regulator for some Intel Processors may allow an unauthenticated user to potentially enable denial of service via network access</li> <li>CVE-2023-38575: Non-transparent sharing of return predictor targets between contexts in some Intel Processors may allow an authorized user to potentially enable information disclosure via local access.</li> <li>CVE-2023-28746: Information exposure through microarchitectural state after transient execution from some register files for some Intel Atom Processors may allow an authenticated user to potentially enable information disclosure via local access.</li> <li>CVE-2023-22655 Protection mechanism failure in some 3rd and 4th Generation Intel Xeon Processors when using Intel SGX or Intel TDX may allow a privileged user to potentially enable escalation of privilege via local access.</li> <li>CVE-2023-43490: Incorrect calculation in microcode keying mechanism for some Intel Xeon D Processors with Intel® SGX may allow a privileged user to potentially enable information disclosure via local access.</li> </ul>
<h2>Patch Instructions:</h2> <p> To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product: </p> <ul class="list-group"> <li class="list-group-item"> SUSE Linux Enterprise Server for SAP Applications 12 SP5 <br/> <code>zypper in -t patch SUSE-SLE-SERVER-12-SP5-2024-917=1</code> </li> <li class="list-group-item"> SUSE Linux Enterprise High Performance Computing 12 SP5 <br/> <code>zypper in -t patch SUSE-SLE-SERVER-12-SP5-2024-917=1</code> </li> <li class="list-group-item"> SUSE Linux Enterprise Server 12 SP5 <br/> <code>zypper in -t patch SUSE-SLE-SERVER-12-SP5-2024-917=1</code> </li> </ul>
<h2>Package List:</h2> <ul> <li> SUSE Linux Enterprise Server for SAP Applications 12 SP5 (x86_64) <ul> <li>ucode-intel-debuginfo-20240312-134.1</li> <li>ucode-intel-debugsource-20240312-134.1</li> <li>ucode-intel-20240312-134.1</li> </ul> </li> <li> SUSE Linux Enterprise High Performance Computing 12 SP5 (x86_64) <ul> <li>ucode-intel-debuginfo-20240312-134.1</li> <li>ucode-intel-debugsource-20240312-134.1</li> <li>ucode-intel-20240312-134.1</li> </ul> </li> <li> SUSE Linux Enterprise Server 12 SP5 (x86_64) <ul> <li>ucode-intel-debuginfo-20240312-134.1</li> <li>ucode-intel-debugsource-20240312-134.1</li> <li>ucode-intel-20240312-134.1</li> </ul> </li> </ul>
<h2>References:</h2> <ul> <li> <a href="https://www.suse.com/security/cve/CVE-2023-22655.html">https://www.suse.com/security/cve/CVE-2023-22655.html</a> </li> <li> <a href="https://www.suse.com/security/cve/CVE-2023-28746.html">https://www.suse.com/security/cve/CVE-2023-28746.html</a> </li> <li> <a href="https://www.suse.com/security/cve/CVE-2023-38575.html">https://www.suse.com/security/cve/CVE-2023-38575.html</a> </li> <li> <a href="https://www.suse.com/security/cve/CVE-2023-39368.html">https://www.suse.com/security/cve/CVE-2023-39368.html</a> </li> <li> <a href="https://www.suse.com/security/cve/CVE-2023-43490.html">https://www.suse.com/security/cve/CVE-2023-43490.html</a> </li> <li> <a href="https://bugzilla.suse.com/show_bug.cgi?id=1221323">https://bugzilla.suse.com/show_bug.cgi?id=1221323</a> </li> </ul> </div>
--===============6878938333988253021==--
|
|
|
|