Intel Fixes Microcode Bug that Could Expose Your Sensitive Data
1 - 2 min read
Dec 31, 2023
It was discovered that a sequence of processor instructions for some Intel processors leads to unexpected behavior that could allow an authenticated local user to escalate privileges (CVE-2023-23583). This bug, dubbed "Reptar," could expose sensitive information or cause system crashes, resulting in denial of service attacks leading to loss of system access.
More recently, another Intel Microcode privilege escalation flaw was discovered. Researchers identified that a sequence of processor instructions leads to unexpected behavior for some Intel(R) Processors that may allow an authenticated user to escalate privileges (CVE-2023-23583). This vulnerability also severely threatens impacted users’ sensitive data and system availability.
What Is Google's Analysis of Reptar?
According to Google Cloud, "The impact of this vulnerability is demonstrated when exploited by an attacker in a multi-tenant virtualized environment, as the exploit on a guest machine causes the host machine to crash, resulting in a Denial of Service to other guest machines running on the same host. The vulnerability could also lead to information disclosure or privilege escalation."
Google security researcher Tavis Normandy also analyzed Reptar and concluded that the flaw could be exploited to corrupt the system state and force a machine-check exception.
What Can I Do To Stay Safe?
An important Intel Microcode update has been released to mitigate this severe bug. Given this vulnerability's damaging repercussions on impacted systems, we urge all affected users to update now to protect against information disclosure and loss of access to their critical systems if left unpatched. Debian, Debian LTS Fedora, Oracle, and Ubuntu have released important security advisory updates addressing Reptar.
To stay on top of essential updates released by the open-source programs and applications you use, register as a LinuxSecurity user, subscribe to our Linux Advisory Watch newsletter, and customize your advisories for your distro(s). This will enable you to stay up-to-date on the latest, most significant issues impacting the security of your systems.
Follow @LS_Advisories on X for real-time updates on advisories for your distro(s).
