Hello Linux users, 

In the wake of the notorious “Reptar” Intel Microcode privilege escalation bug that dominated recent security news headlines, I’m checking back in to alert you of another significant microcode privilege escalation flaw that has been found and fixed.

This stealthy bug could provide attackers with unauthorized access to sensitive data or a malicious actor to launch a denial of service attack, leaving you without access to your critical Linux systems. Sounds like a nightmare, doesn’t it?  

Read on to learn how to mitigate this flaw and find out about other impactful vulnerabilities recently discovered and fixed in your open-source programs and applications.

If you gained valuable information from today’s newsletter, please share it with a fellow security geek. Do you have a Linux security-related topic you'd like to cover for our audience? We welcome contributions from enthusiastic, insightful community members who share our love for Linux and security!

Stay safe out there,

Brittany Signature 150 Esm W150

Intel Microcode 

The Discovery 

Another significant microcode privilege escalation flaw has been found not long after the notorious “Reptar” Intel Microcode privilege escalation bug dominated security news headlines. It was discovered that a sequence of processor instructions leads to unexpected behavior for some Intel(R) Processors that may allow an authenticated user to escalate privileges (CVE-2023-23583). This vulnerability severely threatens impacted users’ sensitive data and system availability.

Intel Microcode Esm W224

The Impact

This vulnerability could compromise sensitive information or denial of denial-of-service attacks, leaving critical systems unavailable.

The Fix

Important Intel Microcode updates have been released to mitigate this severe bug. Given this vulnerability’s significant threat to affected systems, if left unpatched, we urge all impacted users to update now. Prompt patching will keep you ahead of attackers and protect against system downtime and information compromise.

Your Related Advisories:

[distro_list_1]

HAProxy

The Discovery 

Distros to address a recent HAProxy vulnerability that threatens impacted users’ sensitive information with important security advisory updates. This flaw is very straightforward for a remote attacker to exploit and severely threatens impacted users’ sensitive information, making it among the worst bugs we’ve seen in a while!

Haproxy Esm W200

The Impact

With over 44% of the proxy server market share, this flaw is having a widespread impact on Linux users’ security. A remote attacker could easily exploit this vulnerability to steal impacted users’ sensitive data.

The Fix

We urge all impacted users to apply the HAProxy update that has been released to fix this severe bug. Doing so will protect against exploits resulting in data compromise. Don’t let attackers take advantage of your delay - patch now!

Your Related Advisories:

[distro_list_2]

OpenSSH

The Discovery 

Have you updated to fix the recently discovered and mitigated severe vulnerabilities in OpenSSH? Among these bugs is the notorious “Terrapin vulnerability,” tracked as CVE-2023-48795, which allows a man-in-the-middle (MITM) attacker to access impacted users’ sensitive information in transit.

OpenSSH Esm W190

The Impact

The Terrapin attack has had far-reaching implications, given OpenSSH’s widespread use in secure data communications. An attack could compromise your sensitive data as it is transmitted across networks.

The Fix

OpenSSH 9.6 has been released to mitigate the Terrapin bug and several other recent flaws found in OpenSSH. Given these vulnerabilities’ severe threat to affected systems, if left unpatched, we strongly recommend all impacted users update to version 9.6 as soon as possible to fortify their Linux environment against man-in-the-middle attackers and protect their sensitive data from compromise and theft.

Your Related Advisories:

[distro_list_3]