ALAS-2024-1950


Amazon Linux 1 Security Advisory: ALAS-2024-1950
Advisory Release Date: 2024-10-28 17:34 Pacific
Advisory Updated Date: 2024-12-05 20:57 Pacific
Severity: Important

Issue Overview:

2024-12-05: CVE-2024-21820 was added to this advisory.

2024-12-05: CVE-2024-23918 was added to this advisory.

Incorrect default permissions in some Intel(R) Xeon(R) processor memory controller configurations when using Intel(R) SGX may allow a privileged user to potentially enable escalation of privilege via local access. (CVE-2024-21820)

Improper conditions check in some Intel(R) Xeon(R) processor memory controller configurations when using Intel(R) SGX may allow a privileged user to potentially enable escalation of privilege via local access. (CVE-2024-23918)

NOTE: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01103.html
NOTE: https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20240910
DEBIANBUG: [1081363] (CVE-2024-23984)

Incorrect behavior order in transition between executive monitor and SMI transfer monitor (STM) in some Intel(R) Processor may allow a privileged user to potentially enable escalation of privilege via local access. (CVE-2024-24853)

NOTE: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01097.html
NOTE: https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20240910
DEBIANBUG: [1081363] (CVE-2024-24968)

Protection mechanism failure in some 3rd, 4th, and 5th Generation Intel(R) Xeon(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access. (CVE-2024-24980)


Affected Packages:

microcode_ctl


Issue Correction:
Run yum update microcode_ctl to update your system.

New Packages:
i686:
    microcode_ctl-debuginfo-2.1-47.44.amzn1.i686
    microcode_ctl-2.1-47.44.amzn1.i686

src:
    microcode_ctl-2.1-47.44.amzn1.src

x86_64:
    microcode_ctl-debuginfo-2.1-47.44.amzn1.x86_64
    microcode_ctl-2.1-47.44.amzn1.x86_64