Sign-up

ID

VAR-202106-0343


CVE

CVE-2020-24511


TITLE

Red Hat Security Advisory 2021-3027-01

Trust: 0.1

sources: PACKETSTORM: 163757

DESCRIPTION

Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Intel Processors (Intel processors) are Intel Corporation's processors that interpret computer instructions and process data in computer software. An authenticated attacker could exploit this vulnerability to obtain sensitive information. 6 ELS) - i386, x86_64 3. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: microcode_ctl security, bug fix and enhancement update Advisory ID: RHSA-2021:2303-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:2303 Issue date: 2021-06-08 CVE Names: CVE-2020-24489 CVE-2020-24511 CVE-2020-24512 CVE-2020-24513 ==================================================================== 1. Summary: An update for microcode_ctl is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Server AUS (v. 7.6) - x86_64 Red Hat Enterprise Linux Server E4S (v. 7.6) - x86_64 Red Hat Enterprise Linux Server TUS (v. 7.6) - x86_64 3. Description: The microcode_ctl packages provide microcode updates for Intel. Security Fix(es): * hw: vt-d related privilege escalation (CVE-2020-24489) * hw: improper isolation of shared resources in some Intel Processors (CVE-2020-24511) * hw: observable timing discrepancy in some Intel Processors (CVE-2020-24512) * hw: information disclosure on some Intel Atom processors (CVE-2020-24513) Bug Fix(es) and Enhancement(s): * Update Intel CPU microcode to microcode-20210525 release 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1962650 - CVE-2020-24489 hw: vt-d related privilege escalation 1962666 - CVE-2020-24513 hw: information disclosure on some Intel Atom processors 1962702 - CVE-2020-24511 hw: improper isolation of shared resources in some Intel Processors 1962722 - CVE-2020-24512 hw: observable timing discrepancy in some Intel Processors 6. Package List: Red Hat Enterprise Linux Server AUS (v. 7.6): Source: microcode_ctl-2.1-47.21.el7_6.src.rpm x86_64: microcode_ctl-2.1-47.21.el7_6.x86_64.rpm microcode_ctl-debuginfo-2.1-47.21.el7_6.x86_64.rpm Red Hat Enterprise Linux Server E4S (v. 7.6): Source: microcode_ctl-2.1-47.21.el7_6.src.rpm x86_64: microcode_ctl-2.1-47.21.el7_6.x86_64.rpm microcode_ctl-debuginfo-2.1-47.21.el7_6.x86_64.rpm Red Hat Enterprise Linux Server TUS (v. 7.6): Source: microcode_ctl-2.1-47.21.el7_6.src.rpm x86_64: microcode_ctl-2.1-47.21.el7_6.x86_64.rpm microcode_ctl-debuginfo-2.1-47.21.el7_6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2020-24489 https://access.redhat.com/security/cve/CVE-2020-24511 https://access.redhat.com/security/cve/CVE-2020-24512 https://access.redhat.com/security/cve/CVE-2020-24513 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYMAkptzjgjWX9erEAQjQaxAAiXuFV2AZ5UNVNR29EFFEaHsHDTLaeYNm ibgw81yBpSZopPqtVYoznk9JAYc2YSrgbq0/BxC+rWHRTGPom5lZumlkqc+Nkjon sGx6SXU5q9M/nPutM/p5afTXNaHbZVQojjeP9VIpF1qz94JRcJisrumAW/sS27/v Ie6wqizvXNJZq30FOmgAq3vSXJpvakZYrBZoRvdm3MUx3rqiy/Sn62VtexeJoWJf 7BVF9y24rn2r9BuG6QNKGnYTxuUHAfcTAy5laJZ7EWdpEXcSZG6SV6x40Zdg6TaV 8x6PFSbvb2woGvWfFr5so9I92X1z9MCh4vQ5hmPnoHHREXpDKcDjvmfnStNkKD3F kOvf99Ph7E4Th/NhFwAczspiZEJYbvZ7ZenKQwWd2lGnEzFdPU5g5c3n+WVyN1qZ psD/uZlryQyIUyvRPowGppm/vJfyIiDKr+yUpq3AGscs9ASpnH6120ClaQx3KutT gpUbnKDxAW7UMlg5V4A9y5jJBgW8cZGH4qKc9KeDOj1MOjOhrfClInKhfqqY6YF1 8ulHpTKFyXzFjKBST1PKhCQQ2HhG74GoG147R0yHZw+9T0+o3ovlEQTxD2yVgGua 7LQ/vJotdgvBEaYoWTz6WwphiYQpFbbyQ6E0qplPVJMMmFKhDpNKS+ama5CHnfUF 6I3FlLzt1EU=YG8p -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce

Trust: 1.71

sources: NVD: CVE-2020-24511 // VULHUB: VHN-178397 // PACKETSTORM: 163757 // PACKETSTORM: 163031 // PACKETSTORM: 163032 // PACKETSTORM: 163036 // PACKETSTORM: 163037 // PACKETSTORM: 163042 // PACKETSTORM: 163047 // PACKETSTORM: 163993

AFFECTED PRODUCTS

vendor:debianmodel:linuxscope:eqversion:10.0

Trust: 1.0

vendor:netappmodel:fas\/aff biosscope:eqversion: -

Trust: 1.0

vendor:intelmodel:microcodescope:ltversion:20210608

Trust: 1.0

vendor:netappmodel:solidfire biosscope:eqversion: -

Trust: 1.0

vendor:netappmodel:hci compute node biosscope:eqversion: -

Trust: 1.0

sources: NVD: CVE-2020-24511

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-24511
value: MEDIUM

Trust: 1.0

VULHUB: VHN-178397
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2020-24511
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

VULHUB: VHN-178397
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2020-24511
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 2.0
impactScore: 4.0
version: 3.1

Trust: 1.0

sources: VULHUB: VHN-178397 // NVD: CVE-2020-24511

PROBLEMTYPE DATA

problemtype:CWE-668

Trust: 1.1

sources: VULHUB: VHN-178397 // NVD: CVE-2020-24511

EXTERNAL IDS

db:NVDid:CVE-2020-24511

Trust: 1.9

db:SIEMENSid:SSA-309571

Trust: 1.1

db:PACKETSTORMid:163037

Trust: 0.2

db:PACKETSTORMid:163047

Trust: 0.2

db:PACKETSTORMid:163042

Trust: 0.2

db:PACKETSTORMid:163031

Trust: 0.2

db:PACKETSTORMid:163032

Trust: 0.2

db:PACKETSTORMid:163036

Trust: 0.2

db:PACKETSTORMid:163044

Trust: 0.1

db:PACKETSTORMid:163040

Trust: 0.1

db:PACKETSTORMid:163043

Trust: 0.1

db:PACKETSTORMid:163048

Trust: 0.1

db:PACKETSTORMid:163046

Trust: 0.1

db:VULHUBid:VHN-178397

Trust: 0.1

db:PACKETSTORMid:163757

Trust: 0.1

db:PACKETSTORMid:163993

Trust: 0.1

sources: VULHUB: VHN-178397 // PACKETSTORM: 163757 // PACKETSTORM: 163031 // PACKETSTORM: 163032 // PACKETSTORM: 163036 // PACKETSTORM: 163037 // PACKETSTORM: 163042 // PACKETSTORM: 163047 // PACKETSTORM: 163993 // NVD: CVE-2020-24511

REFERENCES

url:https://cert-portal.siemens.com/productcert/pdf/ssa-309571.pdf

Trust: 1.1

url:https://security.netapp.com/advisory/ntap-20210611-0005/

Trust: 1.1

url:https://www.debian.org/security/2021/dsa-4934

Trust: 1.1

url:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html

Trust: 1.1

url:https://lists.debian.org/debian-lts-announce/2021/07/msg00022.html

Trust: 1.1

url:https://access.redhat.com/security/cve/cve-2020-24511

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2020-24512

Trust: 0.8

url:https://access.redhat.com/articles/11258

Trust: 0.8

url:https://access.redhat.com/security/cve/cve-2020-24512

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2020-24489

Trust: 0.8

url:https://access.redhat.com/security/cve/cve-2020-24489

Trust: 0.8

url:https://listman.redhat.com/mailman/listinfo/rhsa-announce

Trust: 0.8

url:https://access.redhat.com/security/updates/classification/#important

Trust: 0.8

url:https://access.redhat.com/security/team/key/

Trust: 0.8

url:https://access.redhat.com/security/team/contact/

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2020-24511

Trust: 0.8

url:https://bugzilla.redhat.com/):

Trust: 0.8

url:https://access.redhat.com/security/cve/cve-2020-24513

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2020-24513

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2020-8696

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2020-8698

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-8698

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-0549

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2020-0543

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2020-8695

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-8695

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2020-0549

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-0543

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2020-8696

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-0548

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2020-0548

Trust: 0.2

url:https://access.redhat.com/errata/rhsa-2021:3027

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2021:2299

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2021:2302

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2021:2300

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2021:2306

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2021:2308

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2021:2303

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2021:3364

Trust: 0.1

sources: VULHUB: VHN-178397 // PACKETSTORM: 163757 // PACKETSTORM: 163031 // PACKETSTORM: 163032 // PACKETSTORM: 163036 // PACKETSTORM: 163037 // PACKETSTORM: 163042 // PACKETSTORM: 163047 // PACKETSTORM: 163993 // NVD: CVE-2020-24511

CREDITS

Red Hat

Trust: 0.8

sources: PACKETSTORM: 163757 // PACKETSTORM: 163031 // PACKETSTORM: 163032 // PACKETSTORM: 163036 // PACKETSTORM: 163037 // PACKETSTORM: 163042 // PACKETSTORM: 163047 // PACKETSTORM: 163993

SOURCES

db:VULHUBid:VHN-178397
db:PACKETSTORMid:163757
db:PACKETSTORMid:163031
db:PACKETSTORMid:163032
db:PACKETSTORMid:163036
db:PACKETSTORMid:163037
db:PACKETSTORMid:163042
db:PACKETSTORMid:163047
db:PACKETSTORMid:163993
db:NVDid:CVE-2020-24511

LAST UPDATE DATE

2026-06-25T21:04:03.993000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-178397date:2021-09-09T00:00:00
db:NVDid:CVE-2020-24511date:2026-06-17T03:05:42.127

SOURCES RELEASE DATE

db:VULHUBid:VHN-178397date:2021-06-09T00:00:00
db:PACKETSTORMid:163757date:2021-08-09T14:15:37
db:PACKETSTORMid:163031date:2021-06-09T13:26:32
db:PACKETSTORMid:163032date:2021-06-09T13:26:50
db:PACKETSTORMid:163036date:2021-06-09T13:28:02
db:PACKETSTORMid:163037date:2021-06-09T13:28:17
db:PACKETSTORMid:163042date:2021-06-09T13:40:32
db:PACKETSTORMid:163047date:2021-06-09T13:42:12
db:PACKETSTORMid:163993date:2021-08-31T16:27:14
db:NVDid:CVE-2020-24511date:2021-06-09T19:15:08.897