Skip to content
OpenAdvisories
Medium ALAS2023-2025-888 3 CVEs

Moderate: microcode_ctl security update (Amazon Linux 2023)

Published Feb 27, 2025 · Updated Mar 5, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-39279: Insufficient granularity of access control in UEFI firmware in some Intel(R) processors may allow a authenticated user to potentially enable denial of service via local access. CVE-2024-37020: Sequence of processor instructions leads to unexpected behavior in the Intel(R) DSA V1.0 for some Intel(R) Xeon(R) Processors may allow an authenticated user to potentially enable denial of service via local access. CVE-2024-31068: Improper Finite State Machines (FSMs) in Hardware Logic for some Intel(R) Processors may allow privileged user to potentially enable denial of service via local access.

Fixed packages 1

ReleasePackageFixed in
Amazon Linux · 2023 microcode_ctl 2:2.1-53.amzn2023.0.11

Vulnerabilities 3

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-31068.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-37020.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-39279.html