6.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
3.5 Low
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:S/C:N/I:P/A:N
0.001 Low
EPSS
Percentile
30.9%
Severity: High
Date : 2021-06-15
CVE-ID : CVE-2020-24511 CVE-2020-24512 CVE-2020-24513 CVE-2021-24489
Package : intel-ucode
Type : multiple issues
Remote : No
Link : https://security.archlinux.org/AVG-2051
The package intel-ucode before version 20210608-1 is vulnerable to
multiple issues including privilege escalation and information
disclosure.
Upgrade to 20210608-1.
The problems have been fixed upstream in version 20210608.
None.
Improper isolation of shared resources in some Intel® Processors may
allow an authenticated user to potentially enable information
disclosure via local access.
Observable timing discrepancy in some Intel® Processors may allow an
authenticated user to potentially enable information disclosure via
local access.
Domain-bypass transient execution vulnerability in some Intel Atom®
Processors may allow an authenticated user to potentially enable
information disclosure via local access.
Incomplete cleanup in some Intel® VT-d products may allow an
authenticated user to potentially enable escalation of privilege via
local access.
A local attacker could escalate privileges or disclose sensitive
information about the processor state using a side-channel attack.
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html
https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20210608
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00465.html
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html
https://security.archlinux.org/CVE-2020-24511
https://security.archlinux.org/CVE-2020-24512
https://security.archlinux.org/CVE-2020-24513
https://security.archlinux.org/CVE-2021-24489
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ArchLinux | any | any | intel-ucode | < 20210608-1 | UNKNOWN |
github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20210608
security.archlinux.org/AVG-2051
security.archlinux.org/CVE-2020-24511
security.archlinux.org/CVE-2020-24512
security.archlinux.org/CVE-2020-24513
security.archlinux.org/CVE-2021-24489
www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html
www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html
www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00465.html
6.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
3.5 Low
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:S/C:N/I:P/A:N
0.001 Low
EPSS
Percentile
30.9%