USN-4628-3: Intel Microcode vulnerabilities | Cloud Foundry

Severity

Medium

Vendor

Canonical Ubuntu

Versions Affected

• Canonical Ubuntu 18.04

Description

USN-4628-1 provided updated Intel Processor Microcode for various processor types. This update provides the corresponding updates for some additional processor types.

Original advisory details:

Moritz Lipp, Michael Schwarz, Andreas Kogler, David Oswald, Catherine Easdon, Claudio Canella, and Daniel Gruss discovered that the Intel Running Average Power Limit (RAPL) feature of some Intel processors allowed a side- channel attack based on power consumption measurements. A local attacker could possibly use this to expose sensitive information. (CVE-2020-8695)

Ezra Caltum, Joseph Nuzman, Nir Shildan and Ofir Joseff discovered that some Intel® Processors did not properly remove sensitive information before storage or transfer in some situations. A local attacker could possibly use this to expose sensitive information. (CVE-2020-8696)

Ezra Caltum, Joseph Nuzman, Nir Shildan and Ofir Joseff discovered that some Intel® Processors did not properly isolate shared resources in some situations. A local attacker could possibly use this to expose sensitive information. (CVE-2020-8698)

CVEs contained in this USN include: CVE-2020-8698, CVE-2020-8696, CVE-2020-8695.

Affected Cloud Foundry Products and Versions

Severity is medium unless otherwise noted.

• Bionic Stemcells
  • 1.x versions prior to 1.10
  • All other stemcells not listed.

Mitigation

Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:

• Bionic Stemcells
  • Upgrade 1.x versions to 1.10 or greater
  • All other stemcells should be upgraded to the latest version available on bosh.io.

References

• USN Notice
• CVE-2020-8698
• CVE-2020-8696
• CVE-2020-8695

History

2021-06-11: Initial vulnerability report published.