RedHat: RHSA-2021-3317:01 Important: microcode_ctl security,

Advisories

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: microcode_ctl security, bug fix and enhancement update
Advisory ID:       RHSA-2021:3317-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2021:3317
Issue date:        2021-08-31
CVE Names:         CVE-2020-0543 CVE-2020-0548 CVE-2020-0549 
                   CVE-2020-8695 CVE-2020-8696 CVE-2020-8698 
                   CVE-2020-24489 CVE-2020-24511 CVE-2020-24512 
=====================================================================

1. Summary:

An update for microcode_ctl is now available for Red Hat Enterprise Linux
7.6 Advanced Update Support.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Server AUS (v. 7.6) - x86_64
Red Hat Enterprise Linux Server E4S (v. 7.6) - x86_64
Red Hat Enterprise Linux Server TUS (v. 7.6) - x86_64

3. Description:

* hw: Vector Register Data Sampling (CVE-2020-0548)

* hw: L1D Cache Eviction Sampling (CVE-2020-0549)

* hw: Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543)

* hw: Information disclosure issue in Intel SGX via RAPL interface
(CVE-2020-8695)

* hw: Vector Register Leakage-Active (CVE-2020-8696)

* hw: Fast forward store predictor (CVE-2020-8698)

* hw: vt-d related privilege escalation (CVE-2020-24489)

* hw: improper isolation of shared resources in some Intel Processors
(CVE-2020-24511)

* hw: observable timing discrepancy in some Intel Processors
(CVE-2020-24512)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1788786 - CVE-2020-0548 hw: Vector Register Data Sampling
1788788 - CVE-2020-0549 hw: L1D Cache Eviction Sampling
1827165 - CVE-2020-0543 hw: Special Register Buffer Data Sampling (SRBDS)
1828583 - CVE-2020-8695 hw: Information disclosure issue in Intel SGX via RAPL interface
1890355 - CVE-2020-8696 hw: Vector Register Leakage-Active
1890356 - CVE-2020-8698 hw: Fast forward store predictor
1962650 - CVE-2020-24489 hw: vt-d related privilege escalation
1962702 - CVE-2020-24511 hw: improper isolation of shared resources in some Intel Processors
1962722 - CVE-2020-24512 hw: observable timing discrepancy in some Intel Processors
1972333 - [rhel-7.6.z] Re-enable 06-5e-03 (SKL-H/S, CPUID 0x506e3) latest microcode updates

6. Package List:

Red Hat Enterprise Linux Server AUS (v. 7.6):

Source:
microcode_ctl-2.1-47.23.el7_6.src.rpm

x86_64:
microcode_ctl-2.1-47.23.el7_6.x86_64.rpm
microcode_ctl-debuginfo-2.1-47.23.el7_6.x86_64.rpm

Red Hat Enterprise Linux Server E4S (v. 7.6):

Source:
microcode_ctl-2.1-47.23.el7_6.src.rpm

x86_64:
microcode_ctl-2.1-47.23.el7_6.x86_64.rpm
microcode_ctl-debuginfo-2.1-47.23.el7_6.x86_64.rpm

Red Hat Enterprise Linux Server TUS (v. 7.6):

Source:
microcode_ctl-2.1-47.23.el7_6.src.rpm

x86_64:
microcode_ctl-2.1-47.23.el7_6.x86_64.rpm
microcode_ctl-debuginfo-2.1-47.23.el7_6.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2020-0543
https://access.redhat.com/security/cve/CVE-2020-0548
https://access.redhat.com/security/cve/CVE-2020-0549
https://access.redhat.com/security/cve/CVE-2020-8695
https://access.redhat.com/security/cve/CVE-2020-8696
https://access.redhat.com/security/cve/CVE-2020-8698
https://access.redhat.com/security/cve/CVE-2020-24489
https://access.redhat.com/security/cve/CVE-2020-24511
https://access.redhat.com/security/cve/CVE-2020-24512
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYS3nXtzjgjWX9erEAQjurA//UMsuk4AjQJxNU+Q7rEVqVhi0B/THmFbj
hQgQ7lNzwh3a2iBl6sPZXhM+8KeCIXV0UcopihXp0Vsyp/luffDhxlpomrdphB2R
vBXGXBAgqCvju81bc/Bhz1EG+IfxfkCq9pM1WTK7Gz7jApJLi0mvzO5igBrmHa7v
oXpKljsQ9/Fp8q986wwFw3fqWcRYMq0AK8XyGYzj+kkFRnaSu/gh/+Cqs3X8pU2o
8oBUeP/RlmHzauTZ6rpb9GSDziigPzofewWJ9j+xVllLlwfS77Tge00fDb1FUfQ2
QnCET5urY5W2fqHpZcPi8P5igRKNJ9XS4FXMTVk1Hyj1LA8K1Hh8p+81uVkQT3gK
e2QP8JI3MleCQcZm0XPFEvX/hA5/CpUrRLAMrOotjRpqV3DHHolv2KqFqfT96+j6
D3sMB5kOQ2ahabM6ET/1dyJgEKWvHPxpmK8L5llK9dny4BuKD3IWpD4Nd17RR9Nr
q7HbzzSAm8OlTQH5fV0BD1TiEwIU709QWtXvufLHmPg+bVHmVbbvMAHYmCn4jqrq
OlTi4drHd0N6Z2DZMZ+56TrSJHgd/zFpZviTfeUzOq3x8Tqs25mLf/Xajqq3kWUt
aWq+FD+GFuQgIEgYF3f43etWN9/WD/w18m0UPmmaNW/9gWe22oGVJLaavKyGloUP
xkOsGdxEg2c=
=dx7d
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2021-3317:01 Important: microcode_ctl security,

An update for microcode_ctl is now available for Red Hat Enterprise Linux 7.6 Advanced Update Support

Summary

* hw: Vector Register Data Sampling (CVE-2020-0548)
* hw: L1D Cache Eviction Sampling (CVE-2020-0549)
* hw: Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543)
* hw: Information disclosure issue in Intel SGX via RAPL interface (CVE-2020-8695)
* hw: Vector Register Leakage-Active (CVE-2020-8696)
* hw: Fast forward store predictor (CVE-2020-8698)
* hw: vt-d related privilege escalation (CVE-2020-24489)
* hw: improper isolation of shared resources in some Intel Processors (CVE-2020-24511)
* hw: observable timing discrepancy in some Intel Processors (CVE-2020-24512)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released erratarelevant to your system have been applied.For details on how to apply this update, refer to:https://access.redhat.com/articles/11258

References

https://access.redhat.com/security/cve/CVE-2020-0543 https://access.redhat.com/security/cve/CVE-2020-0548 https://access.redhat.com/security/cve/CVE-2020-0549 https://access.redhat.com/security/cve/CVE-2020-8695 https://access.redhat.com/security/cve/CVE-2020-8696 https://access.redhat.com/security/cve/CVE-2020-8698 https://access.redhat.com/security/cve/CVE-2020-24489 https://access.redhat.com/security/cve/CVE-2020-24511 https://access.redhat.com/security/cve/CVE-2020-24512 https://access.redhat.com/security/updates/classification/#important

Package List

Red Hat Enterprise Linux Server AUS (v. 7.6):
Source: microcode_ctl-2.1-47.23.el7_6.src.rpm
x86_64: microcode_ctl-2.1-47.23.el7_6.x86_64.rpm microcode_ctl-debuginfo-2.1-47.23.el7_6.x86_64.rpm
Red Hat Enterprise Linux Server E4S (v. 7.6):
Source: microcode_ctl-2.1-47.23.el7_6.src.rpm
x86_64: microcode_ctl-2.1-47.23.el7_6.x86_64.rpm microcode_ctl-debuginfo-2.1-47.23.el7_6.x86_64.rpm
Red Hat Enterprise Linux Server TUS (v. 7.6):
Source: microcode_ctl-2.1-47.23.el7_6.src.rpm
x86_64: microcode_ctl-2.1-47.23.el7_6.x86_64.rpm microcode_ctl-debuginfo-2.1-47.23.el7_6.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

Severity
Advisory ID: RHSA-2021:3317-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2021:3317
Issued Date: : 2021-08-31
CVE Names: CVE-2020-0543 CVE-2020-0548 CVE-2020-0549 CVE-2020-8695 CVE-2020-8696 CVE-2020-8698 CVE-2020-24489 CVE-2020-24511 CVE-2020-24512

Topic

An update for microcode_ctl is now available for Red Hat Enterprise Linux7.6 Advanced Update Support.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Relevant Releases Architectures

Red Hat Enterprise Linux Server AUS (v. 7.6) - x86_64

Red Hat Enterprise Linux Server E4S (v. 7.6) - x86_64

Red Hat Enterprise Linux Server TUS (v. 7.6) - x86_64

Bugs Fixed

1788786 - CVE-2020-0548 hw: Vector Register Data Sampling

1788788 - CVE-2020-0549 hw: L1D Cache Eviction Sampling

1827165 - CVE-2020-0543 hw: Special Register Buffer Data Sampling (SRBDS)

1828583 - CVE-2020-8695 hw: Information disclosure issue in Intel SGX via RAPL interface

1890355 - CVE-2020-8696 hw: Vector Register Leakage-Active

1890356 - CVE-2020-8698 hw: Fast forward store predictor

1962650 - CVE-2020-24489 hw: vt-d related privilege escalation

1962702 - CVE-2020-24511 hw: improper isolation of shared resources in some Intel Processors

1962722 - CVE-2020-24512 hw: observable timing discrepancy in some Intel Processors

1972333 - [rhel-7.6.z] Re-enable 06-5e-03 (SKL-H/S, CPUID 0x506e3) latest microcode updates

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.