Skip to content
OpenAdvisories
High ALAS2-2024-2682 7 CVEs

Important: microcode_ctl security update (Amazon Linux 2)

Published Oct 24, 2024 · Updated Dec 5, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-24980: Protection mechanism failure in some 3rd, 4th, and 5th Generation Intel(R) Xeon(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access. CVE-2024-24968: Improper finite state machines (FSMs) in hardware logic in some Intel(R) Processors may allow an privileged user to potentially enable a denial of service via local access. CVE-2024-24853: Incorrect behavior order in transition between executive monitor and SMI transfer monitor (STM) in some Intel(R) Processor may allow a privileged user to potentially enable escalation of privilege via local access. CVE-2024-23984: Observable discrepancy in RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access. CVE-2024-23918: Improper conditions check in some Intel(R) Xeon(R) processor memory controller configurations when using Intel(R) SGX may allow a privileged user to potentially enable escalation of privilege via local access. CVE-2024-21853: Improper finite state machines (FSMs) in the hardware logic in some 4th and 5th Generation Intel(R) Xeon(R) Processors may allow an authorized user to potentially enable denial of service via local access. CVE-2024-21820: Incorrect default permissions in some Intel(R) Xeon(R) processor memory controller configurations when using Intel(R) SGX may allow a privileged user to potentially enable escalation of privilege via local access.

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2 microcode_ctl 2:2.1-47.amzn2.4.22
Amazon Linux · 2 microcode_ctl-debuginfo 2:2.1-47.amzn2.4.22

Vulnerabilities 7

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-21820.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-21853.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-23918.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-23984.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-24853.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-24968.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-24980.html