Lucene search

K
cloudfoundryCloud FoundryCFOUNDRY:660D361DC183C30045109A93EFDA1AE1
HistoryJun 11, 2021 - 12:00 a.m.

USN-4628-3: Intel Microcode vulnerabilities | Cloud Foundry

2021-06-1100:00:00
Cloud Foundry
www.cloudfoundry.org
21

0.0005 Low

EPSS

Percentile

17.6%

Severity

Medium

Vendor

Canonical Ubuntu

Versions Affected

  • Canonical Ubuntu 18.04

Description

USN-4628-1 provided updated Intel Processor Microcode for various processor types. This update provides the corresponding updates for some additional processor types.

Original advisory details:

Moritz Lipp, Michael Schwarz, Andreas Kogler, David Oswald, Catherine Easdon, Claudio Canella, and Daniel Gruss discovered that the Intel Running Average Power Limit (RAPL) feature of some Intel processors allowed a side- channel attack based on power consumption measurements. A local attacker could possibly use this to expose sensitive information. (CVE-2020-8695)

Ezra Caltum, Joseph Nuzman, Nir Shildan and Ofir Joseff discovered that some Intel® Processors did not properly remove sensitive information before storage or transfer in some situations. A local attacker could possibly use this to expose sensitive information. (CVE-2020-8696)

Ezra Caltum, Joseph Nuzman, Nir Shildan and Ofir Joseff discovered that some Intel® Processors did not properly isolate shared resources in some situations. A local attacker could possibly use this to expose sensitive information. (CVE-2020-8698)

CVEs contained in this USN include: CVE-2020-8698, CVE-2020-8696, CVE-2020-8695.

Affected Cloud Foundry Products and Versions

Severity is medium unless otherwise noted.

  • Bionic Stemcells
    • 1.x versions prior to 1.10
    • All other stemcells not listed.

Mitigation

Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:

  • Bionic Stemcells
    • Upgrade 1.x versions to 1.10 or greater
    • All other stemcells should be upgraded to the latest version available on bosh.io.

References

History

2021-06-11: Initial vulnerability report published.

CPENameOperatorVersion
bionic stemcellslt1.10