| Description: | Summary:
The remote host is missing an update for the 'microcode_ctl' package(s) announced via the SUSE-SU-2025:1032-1 advisory.
Vulnerability Insight:
This update for microcode_ctl fixes the following issues:
- CVE-2024-31068: Improper Finite State Machines (FSMs) in Hardware
Logic for some Intel Processors may allow privileged user to
potentially enable denial of service via local access. (bsc#1237096)
- CVE-2024-36293: A potential security vulnerability in some Intel
Software Guard Extensions (Intel SGX) Platforms may allow denial
of service. Intel is releasing microcode updates to mitigate this
potential vulnerability. (bsc#1237096)
- CVE-2024-39355: A potential security vulnerability in some
13th and 14th Generation Intel Core Processors may allow denial
of service. Intel is releasing microcode and UEFI reference code
updates to mitigate this potential vulnerability. (bsc#1237096)
- CVE-2024-37020: A potential security vulnerability in the Intel
Data Streaming Accelerator (Intel DSA) for some Intel Xeon Processors
may allow denial of service. Intel is releasing software updates to
mitigate this potential vulnerability. (bsc#1237096)
- CVE-2024-21853: Faulty finite state machines (FSMs) in the hardware logic
in some 4th and 5th Generation Intel Xeon Processors may allow an
authorized user to potentially enable denial of service via local access. (bsc#1233313)
- CVE-2024-23918: Improper conditions check in some Intel Xeon processor
memory controller configurations when using Intel SGX may allow a
privileged user to potentially enable escalation of privilege via
local access. (bsc#1233313)
- CVE-2024-21820: Incorrect default permissions in some Intel Xeon processor
memory controller configurations when using Intel SGX may allow a privileged
user to potentially enable escalation of privilege via local access. (bsc#1233313)
- CVE-2024-24968: Improper finite state machines (FSMs) in hardware logic in
some Intel Processors may allow an privileged user to potentially enable a
denial of service via local access. (bsc#1230400)
- CVE-2024-23984: Observable discrepancy in RAPL interface for some Intel
Processors may allow a privileged user to potentially enable information
disclosure via local access. (bsc#1230400)
- CVE-2024-24853: Incorrect behavior order in transition between executive
monitor and SMI transfer monitor (STM) in some Intel(R) Processor may
allow a privileged user to potentially enable escalation of privilege
via local access. (bsc#1229129)
- CVE-2024-25939: Mirrored regions with different values in 3rd Generation Intel(R)
Xeon(R) Scalable Processors may allow a privileged user to potentially enable
denial of service via local access. (bsc#1229129)
- CVE-2024-24980: Protection mechanism failure in some 3rd, 4th, and 5th Generation
Intel(R) Xeon(R) Processors may allow a privileged user to potentially enable
escalation of privilege via local access. (bsc#1229129)
- CVE-2023-42667: Improper isolation in the Intel(R) Core(TM) Ultra Processor stream
cache mechanism may ... [Please see the references for more information on the vulnerabilities]
Affected Software/OS:
'microcode_ctl' package(s) on SUSE Linux Enterprise Server 11-SP4.
Solution:
Please install the updated package(s).
CVSS Score:
6.8
CVSS Vector:
AV:L/AC:L/Au:S/C:C/I:C/A:C
|
