USN-5486-1: Intel Microcode vulnerabilities

Severity

Medium

Vendor

Canonical Ubuntu

Description

It was discovered that some Intel processors did not implement sufficient control flow management. A local attacker could use this to cause a denial of service. (CVE-2021-0127) Joseph Nuzman discovered that some Intel processors did not properly initialise shared resources. A local attacker could use this to obtain sensitive information. (CVE-2021-0145) Mark Ermolov, Dmitry Sklyarov and Maxim Goryachy discovered that some Intel processors did not prevent test and debug logic from being activated at runtime. A local attacker could use this to escalate privileges. (CVE-2021-0146) It was discovered that some Intel processors did not properly restrict access in some situations. A local attacker could use this to obtain sensitive information. (CVE-2021-33117) Brandon Miller discovered that some Intel processors did not properly restrict access in some situations. A local attacker could use this to obtain sensitive information or a remote attacker could use this to cause a denial of service. (CVE-2021-33120) It was discovered that some Intel processors did not completely perform cleanup actions on multi-core shared buffers. A local attacker could possibly use this to expose sensitive information. (CVE-2022-21123, CVE-2022-21127) Alysa Milburn, Jason Brandt, Avishai Redelman and Nir Lavi discovered that some Intel processors improperly optimised security-critical code. A local attacker could possibly use this to expose sensitive information. (CVE-2022-21151) It was discovered that some Intel processors did not properly perform cleanup during specific special register write operations. A local attacker could possibly use this to expose sensitive information. (CVE-2022-21166) Update Instructions: Run `sudo ua fix USN-5486-1` to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: intel-microcode – 3.20220510.0ubuntu0.18.04.1 No subscription required

CVEs contained in this USN include: CVE-2021-0127, CVE-2021-0145, CVE-2021-0146, CVE-2021-33117, CVE-2021-33120, CVE-2022-21123, CVE-2022-21127, CVE-2022-21151, CVE-2022-21166.

Affected Cloud Foundry Products and Versions

Severity is medium unless otherwise noted.

• Bionic Stemcells
  • 1.x versions prior to 1.90
  • All other stemcells not listed.
• CF Deployment
  • All versions with Bionic Stemcells prior to 1.90

Mitigation

Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:

• Bionic Stemcells
  • Upgrade 1.x versions to 1.90 or greater
  • All other stemcells should be upgraded to the latest version available on bosh.io.
• CF Deployment
  • For all versions, upgrade Bionic Stemcells to 1.90 or greater

History

2022-06-30: Initial vulnerability report published.