Skip to content
OpenAdvisories
Medium ALAS2-2025-2787 3 CVEs

Moderate: microcode_ctl security update (Amazon Linux 2)

Published Feb 26, 2025 · Updated Mar 7, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-39279: Insufficient granularity of access control in UEFI firmware in some Intel(R) processors may allow a authenticated user to potentially enable denial of service via local access. CVE-2024-37020: Sequence of processor instructions leads to unexpected behavior in the Intel(R) DSA V1.0 for some Intel(R) Xeon(R) Processors may allow an authenticated user to potentially enable denial of service via local access. CVE-2024-31068: Improper Finite State Machines (FSMs) in Hardware Logic for some Intel(R) Processors may allow privileged user to potentially enable denial of service via local access.

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2 microcode_ctl 2:2.1-47.amzn2.4.23
Amazon Linux · 2 microcode_ctl-debuginfo 2:2.1-47.amzn2.4.23

Vulnerabilities 3

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-31068.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-37020.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-39279.html