Amazon Linux 2 : microcode_ctl, --advisory ALAS2-2026-3872 (ALAS-2026-3872)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2 Security Advisory ALAS-2026-3872.
##

include('compat.inc');

if (description)
{
  script_id(341906);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/31");

  script_cve_id(
    "CVE-2025-31936",
    "CVE-2025-31938",
    "CVE-2025-35973",
    "CVE-2026-20707",
    "CVE-2026-20713",
    "CVE-2026-20716",
    "CVE-2026-20901",
    "CVE-2026-20917"
  );

  script_name(english:"Amazon Linux 2 : microcode_ctl, --advisory ALAS2-2026-3872 (ALAS-2026-3872)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux 2 host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of microcode_ctl installed on the remote host is prior to 2.1-47. It is, therefore, affected by multiple
vulnerabilities as referenced in the ALAS2-2026-3872 advisory.

    Improper handling of overlap between protected memory ranges for some Intel(R) Xeon(R) 6 processors when
    using Intel(R) TDX within SMM may allow an escalation of privilege. SMM adversary with a privileged user
    combined with a high complexity attack may enable escalation of privilege. This result may potentially
    occur via local access when attack requirements are present with special internal knowledge and requires
    no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high)
    and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none),
    integrity (none) and availability (none) impacts. (CVE-2025-31936)

    Insufficient granularity of access control in some subsystem for some Intel(R) Xeon(R) 6 Scalable
    processors with Intel(R) TDX may allow an information disclosure. Authorized adversary with an
    authenticated user combined with a high complexity attack may enable data exposure. This result may
    potentially occur via local access when attack requirements are present with special internal knowledge
    and requires no user interaction. The potential vulnerability may impact the confidentiality (none),
    integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system
    confidentiality (high), integrity (none) and availability (none) impacts. (CVE-2025-31938)

    Improper handling of values for some Intel(R) Processors within Ring 0: Kernel, Hypervisor and Bare Metal
    OS may allow an escalation of privilege. Authorized adversary with a privileged user combined with a high
    complexity attack may enable escalation of privilege. This result may potentially occur via local access
    when attack requirements are present with special internal knowledge and require no user interaction. The
    potential vulnerability may impact the confidentiality (low), integrity (low) and availability (none) of
    the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and
    availability (none) impacts. (CVE-2025-35973)

    Hardware logic contains race conditions for some 3rd Gen Intel(R) Xeon(R) Scalable Processors within Ring
    3: unprivileged software may allow a denial of service. Unprivileged software adversary with an
    authenticated user combined with a high complexity attack may enable denial of service. This result may
    potentially occur via local access when attack requirements are not present with special internal
    knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality
    (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system
    confidentiality (none), integrity (none) and availability (high) impacts. (CVE-2026-20707)

    Always-incorrect control flow implementation in some firmware for some Intel(R) Xeon(R) processors may
    allow an escalation of privilege. System software adversary with a privileged user combined with a high
    complexity attack may enable escalation of privilege. This result may potentially occur via local access
    when attack requirements are not present without special internal knowledge and requires no user
    interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and
    availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high),
    integrity (high) and availability (none) impacts. (CVE-2026-20713)

    Improper access control for some Intel(R) Processors within Ring 3: User Applications may allow an
    escalation of privilege. Simple hardware adversary with an authenticated user combined with a high
    complexity attack may enable escalation of privilege. This result may potentially occur via local access
    when attack requirements are present with special internal knowledge and requires no user interaction. The
    potential vulnerability may impact the confidentiality (high), integrity (high) and availability (none) of
    the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and
    availability (none) impacts. (CVE-2026-20716)

    Improper input validation for some Intel(R) Xeon(R) processors within firmware may allow an escalation of
    privilege. Startup code and smm adversary with a privileged user combined with a high complexity attack
    may enable data alteration. This result may potentially occur via local access when attack requirements
    are present without special internal knowledge and requires no user interaction. The potential
    vulnerability may impact the confidentiality (none), integrity (none) and availability (none) of the
    vulnerable system, resulting in subsequent system confidentiality (none), integrity (high) and
    availability (none) impacts. (CVE-2026-20901)

    Exposure of sensitive information caused by incorrect data forwarding during transient execution for some
    Intel(R) Processors within Ring 0: Hypervisor and Kernel may allow information disclosure. System software
    adversary with a privileged user combined with a high complexity attack may enable data exposure. This
    result may potentially occur via local access when attack requirements are not present without special
    internal knowledge and requires no user interaction. The potential vulnerability may impact the
    confidentiality (none), integrity (none) and availability (none) of the vulnerable system, resulting in
    subsequent system confidentiality (high), integrity (none) and availability (none) impacts.
    (CVE-2026-20917)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com//AL2/ALAS2-2026-3872.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2025-31936.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2025-31938.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2025-35973.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-20707.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-20713.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-20716.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-20901.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-20917.html");
  script_set_attribute(attribute:"solution", value:
"Run 'yum update microcode_ctl' or
  or 'yum update --advisory ALAS2-2026-3872' to update your system.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:H/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-20716");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/31");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:microcode_ctl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:microcode_ctl-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Amazon Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}

include("rpm2.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "2")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var pkgs = [
    {'reference':'microcode_ctl-2.1-47.amzn2.4.28', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'microcode_ctl-2.1-47.amzn2.4.28', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'microcode_ctl-debuginfo-2.1-47.amzn2.4.28', 'cpu':'i686', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'microcode_ctl-debuginfo-2.1-47.amzn2.4.28', 'cpu':'x86_64', 'release':'AL2', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  var cves = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "microcode_ctl / microcode_ctl-debuginfo");
}