7.9 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
7.3 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
48.0%
The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6797-1 advisory.
It was discovered that some 3rd and 4th Generation Intel Xeon Processors did not properly restrict access to certain hardware features when using Intel SGX or Intel TDX. This may allow a privileged local user to potentially further escalate their privileges on the system. This issue only affected Ubuntu 23.10, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04 LTS and Ubuntu 16.04 LTS. (CVE-2023-22655)
It was discovered that some Intel Atom Processors did not properly clear register state when performing various operations. A local attacker could use this to obtain sensitive information via a transient execution attack. This issue only affected Ubuntu 23.10, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04 LTS and Ubuntu 16.04 LTS. (CVE-2023-28746)
It was discovered that some Intel Processors did not properly clear the state of various hardware structures when switching execution contexts. A local attacker could use this to access privileged information. This issue only affected Ubuntu 23.10, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04 LTS and Ubuntu 16.04 LTS. (CVE-2023-38575)
It was discovered that some Intel Processors did not properly enforce bus lock regulator protections. A remote attacker could use this to cause a denial of service. This issue only affected Ubuntu 23.10, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04 LTS and Ubuntu 16.04 LTS. (CVE-2023-39368)
It was discovered that some Intel Xeon D Processors did not properly calculate the SGX base key when using Intel SGX. A privileged local attacker could use this to obtain sensitive information. This issue only affected Ubuntu 23.10, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04 LTS and Ubuntu 16.04 LTS.
(CVE-2023-43490)
It was discovered that some Intel Processors did not properly protect against concurrent accesses. A local attacker could use this to obtain sensitive information. (CVE-2023-45733)
It was discovered that some Intel Processors TDX module software did not properly validate input. A privileged local attacker could use this information to potentially further escalate their privileges on the system. (CVE-2023-45745, CVE-2023-47855)
It was discovered that some Intel Core Ultra processors did not properly handle particular instruction sequences. A local attacker could use this issue to cause a denial of service.
(CVE-2023-46103)
Tenable has extracted the preceding description block directly from the Ubuntu security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Ubuntu Security Notice USN-6797-1. The text
# itself is copyright (C) Canonical, Inc. See
# <https://ubuntu.com/security/notices>. Ubuntu(R) is a registered
# trademark of Canonical, Inc.
##
include('compat.inc');
if (description)
{
script_id(198069);
script_version("1.1");
script_set_attribute(attribute:"plugin_modification_date", value:"2024/05/29");
script_cve_id(
"CVE-2023-22655",
"CVE-2023-28746",
"CVE-2023-38575",
"CVE-2023-39368",
"CVE-2023-43490",
"CVE-2023-45733",
"CVE-2023-45745",
"CVE-2023-46103",
"CVE-2023-47855"
);
script_xref(name:"USN", value:"6797-1");
script_name(english:"Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 / 24.04 LTS : Intel Microcode vulnerabilities (USN-6797-1)");
script_set_attribute(attribute:"synopsis", value:
"The remote Ubuntu host is missing one or more security updates.");
script_set_attribute(attribute:"description", value:
"The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 / 24.04 LTS host has a package installed that is
affected by multiple vulnerabilities as referenced in the USN-6797-1 advisory.
It was discovered that some 3rd and 4th Generation Intel Xeon Processors did not properly restrict
access to certain hardware features when using Intel SGX or Intel TDX. This may allow a privileged
local user to potentially further escalate their privileges on the system. This issue only affected Ubuntu
23.10, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04 LTS and Ubuntu 16.04 LTS. (CVE-2023-22655)
It was discovered that some Intel Atom Processors did not properly clear register state when
performing various operations. A local attacker could use this to obtain sensitive information via a
transient execution attack. This issue only affected Ubuntu 23.10, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS,
Ubuntu 18.04 LTS and Ubuntu 16.04 LTS. (CVE-2023-28746)
It was discovered that some Intel Processors did not properly clear the state of various hardware
structures when switching execution contexts. A local attacker could use this to access privileged
information. This issue only affected Ubuntu 23.10, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04 LTS
and Ubuntu 16.04 LTS. (CVE-2023-38575)
It was discovered that some Intel Processors did not properly enforce bus lock regulator protections. A
remote attacker could use this to cause a denial of service. This issue only affected Ubuntu 23.10, Ubuntu
22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04 LTS and Ubuntu 16.04 LTS. (CVE-2023-39368)
It was discovered that some Intel Xeon D Processors did not properly calculate the SGX base key when
using Intel SGX. A privileged local attacker could use this to obtain sensitive information. This issue
only affected Ubuntu 23.10, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04 LTS and Ubuntu 16.04 LTS.
(CVE-2023-43490)
It was discovered that some Intel Processors did not properly protect against concurrent accesses. A
local attacker could use this to obtain sensitive information. (CVE-2023-45733)
It was discovered that some Intel Processors TDX module software did not properly validate input. A
privileged local attacker could use this information to potentially further escalate their privileges on
the system. (CVE-2023-45745, CVE-2023-47855)
It was discovered that some Intel Core Ultra processors did not properly handle particular
instruction sequences. A local attacker could use this issue to cause a denial of service.
(CVE-2023-46103)
Tenable has extracted the preceding description block directly from the Ubuntu security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
script_set_attribute(attribute:"see_also", value:"https://ubuntu.com/security/notices/USN-6797-1");
script_set_attribute(attribute:"solution", value:
"Update the affected intel-microcode package.");
script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:M/C:C/I:C/A:N");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-47855");
script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2023-45745");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_set_attribute(attribute:"vuln_publication_date", value:"2024/03/12");
script_set_attribute(attribute:"patch_publication_date", value:"2024/05/29");
script_set_attribute(attribute:"plugin_publication_date", value:"2024/05/29");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:16.04:-:lts");
script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:18.04:-:lts");
script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:20.04:-:lts");
script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:22.04:-:lts");
script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:23.10");
script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:24.04:-:lts");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:intel-microcode");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Ubuntu Local Security Checks");
script_copyright(english:"Ubuntu Security Notice (C) 2024 Canonical, Inc. / NASL script (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");
exit(0);
}
include('debian_package.inc');
if ( ! get_kb_item('Host/local_checks_enabled') ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/Ubuntu/release');
if ( isnull(os_release) ) audit(AUDIT_OS_NOT, 'Ubuntu');
os_release = chomp(os_release);
if (! ('16.04' >< os_release || '18.04' >< os_release || '20.04' >< os_release || '22.04' >< os_release || '23.10' >< os_release || '24.04' >< os_release)) audit(AUDIT_OS_NOT, 'Ubuntu 16.04 / 18.04 / 20.04 / 22.04 / 23.10 / 24.04', 'Ubuntu ' + os_release);
if ( ! get_kb_item('Host/Debian/dpkg-l') ) audit(AUDIT_PACKAGE_LIST_MISSING);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);
var pkgs = [
{'osver': '16.04', 'pkgname': 'intel-microcode', 'pkgver': '3.20240514.0ubuntu0.16.04.1+esm1'},
{'osver': '18.04', 'pkgname': 'intel-microcode', 'pkgver': '3.20240514.0ubuntu0.18.04.1+esm1'},
{'osver': '20.04', 'pkgname': 'intel-microcode', 'pkgver': '3.20240514.0ubuntu0.20.04.1'},
{'osver': '22.04', 'pkgname': 'intel-microcode', 'pkgver': '3.20240514.0ubuntu0.22.04.1'},
{'osver': '23.10', 'pkgname': 'intel-microcode', 'pkgver': '3.20240514.0ubuntu0.23.10.1'},
{'osver': '24.04', 'pkgname': 'intel-microcode', 'pkgver': '3.20240514.0ubuntu0.24.04.1'}
];
var flag = 0;
foreach package_array ( pkgs ) {
var osver = NULL;
var pkgname = NULL;
var pkgver = NULL;
if (!empty_or_null(package_array['osver'])) osver = package_array['osver'];
if (!empty_or_null(package_array['pkgname'])) pkgname = package_array['pkgname'];
if (!empty_or_null(package_array['pkgver'])) pkgver = package_array['pkgver'];
if (osver && pkgname && pkgver) {
if (ubuntu_check(osver:osver, pkgname:pkgname, pkgver:pkgver)) flag++;
}
}
if (flag)
{
security_report_v4(
port : 0,
severity : SECURITY_WARNING,
extra : ubuntu_report_get()
);
exit(0);
}
else
{
var tested = ubuntu_pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'intel-microcode');
}
Vendor | Product | Version | CPE |
---|---|---|---|
canonical | ubuntu_linux | 23.10 | cpe:/o:canonical:ubuntu_linux:23.10 |
canonical | ubuntu_linux | 20.04 | cpe:/o:canonical:ubuntu_linux:20.04:-:lts |
canonical | ubuntu_linux | 16.04 | cpe:/o:canonical:ubuntu_linux:16.04:-:lts |
canonical | ubuntu_linux | 24.04 | cpe:/o:canonical:ubuntu_linux:24.04:-:lts |
canonical | ubuntu_linux | 18.04 | cpe:/o:canonical:ubuntu_linux:18.04:-:lts |
canonical | ubuntu_linux | 22.04 | cpe:/o:canonical:ubuntu_linux:22.04:-:lts |
canonical | ubuntu_linux | intel-microcode | p-cpe:/a:canonical:ubuntu_linux:intel-microcode |
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22655
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28746
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38575
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39368
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-43490
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45733
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45745
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46103
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-47855
ubuntu.com/security/notices/USN-6797-1
7.9 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
7.3 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
48.0%