CVE-2020-24513

Domain-bypass transient execution vulnerability in some Intel Atom(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

Domain-bypass transient execution vulnerability in some Intel Atom(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

This is a tool to transform and deploy microcode update for x86 CPUs.

Security Fix(es):

Incomplete cleanup in some Intel(R) VT-d products may allow an authenticated user to potentially enable escalation of privilege via local access.(CVE-2020-24489)

Domain-bypass transient execution vulnerability in some Intel Atom(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.(CVE-2020-24513)

Hardware allows activation of test or debug logic at runtime for some Intel(R) processors which may allow an unauthenticated user to potentially enable escalation of privilege via physical access.(CVE-2021-0146)

The microcode_ctl packages provide microcode updates for Intel.

Security Fix(es):

• hw: vt-d related privilege escalation (CVE-2020-24489)

• hw: improper isolation of shared resources in some Intel Processors (CVE-2020-24511)

• hw: observable timing discrepancy in some Intel Processors (CVE-2020-24512)

• hw: information disclosure on some Intel Atom processors (CVE-2020-24513)

Bug Fix(es) and Enhancement(s):

• Update Intel CPU microcode to microcode-20210525 release

Domain-bypass transient execution vulnerability in some Intel Atom(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

• Do not use "grep -q" in a pipe in check_caveats.
• Update Intel CPU microcode to microcode-20210608 release:
  • Fixes in releasenote.md file.
• Update Intel CPU microcode to microcode-20210525 release, addresses CVE-2020-24489, CVE-2020-24511, CVE-2020-24512, and CVE-2020-24513 (#1962659, #1962709, #1962729, #1962675):
  • Addition of 06-55-05/0xb7 (CLX-SP A0) microcode at revision 0x3000010;
  • Addition of 06-6a-05/0x87 (ICX-SP C0) microcode at revision 0xc0002f0;
  • Addition of 06-6a-06/0x87 (ICX-SP D0) microcode at revision 0xd0002a0;
  • Addition of 06-86-04/0x01 (SNR B0) microcode at revision 0xb00000f;
  • Addition of 06-86-05/0x01 (SNR B1) microcode (in intel-ucode/06-86-04) at revision 0xb00000f;
  • Addition of 06-86-04/0x01 (SNR B0) microcode (in intel-ucode/06-86-05) at revision 0xb00000f;
  • Addition of 06-86-05/0x01 (SNR B1) microcode at revision 0xb00000f;
  • Addition of 06-8c-02/0xc2 (TGL-R C0) microcode at revision 0x16;
  • Addition of 06-8d-01/0xc2 (TGL-H R0) microcode at revision 0x2c;
  • Addition of 06-96-01/0x01 (EHL B1) microcode at revision 0x11;
  • Addition of 06-9c-00/0x01 (JSL A0/A1) microcode at revision 0x1d;
  • Addition of 06-a7-01/0x02 (RKL-S B0) microcode at revision 0x40;
  • Update of 06-4e-03/0xc0 (SKL-U/U 2+3e/Y D0/K1) microcode (in intel-06-4e-03/intel-ucode/06-4e-03) from revision 0xe2 up to 0xea;
  • Update of 06-4f-01/0xef (BDX-E/EP/EX/ML B0/M0/R0) microcode (in intel-06-4f-01/intel-ucode/06-4f-01) from revision 0xb000038 up to 0xb00003e;
  • Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006a0a up to 0x2006b06;
  • Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 N0/R0/S0) microcode (in intel-06-5e-03/intel-ucode/06-5e-03) from revision 0xe2 up to 0xea;
  • Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in intel-06-8c-01/intel-ucode/06-8c-01) from revision 0x68 up to 0x88;
  • Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xde up to 0xea;
  • Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xde up to 0xea;
  • Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0a) from revision 0xe0 up to 0xea;
  • Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0b) from revision 0xde up to 0xea;
  • Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from revision 0xde up to 0xea;
  • Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-09) from revision 0xde up to 0xea;
  • Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0a) from revision 0xde up to 0xea;
  • Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0b) from revision 0xde up to 0xea;
  • Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0c) from revision 0xde up to 0xea;
  • Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0xde up to 0xea;
  • Update of 06-3f-02/0x6f (HSX-E/EN/EP/EP 4S C0/C1/M1/R2) microcode from revision 0x44 up to 0x46;
  • Update of 06-3f-04/0x80 (HSX-EX E0) microcode from revision 0x16 up to 0x19;
  • Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000159 up to 0x100015b;
  • Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4003006 up to 0x4003102;
  • Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision 0x5003006 up to 0x5003102;
  • Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x700001e up…

• Do not use "grep -q" in a pipe in check_caveats.
• Update Intel CPU microcode to microcode-20210608 release:
  • Fixes in releasenote.md file.
• Update Intel CPU microcode to microcode-20210525 release, addresses CVE-2020-24489, CVE-2020-24511, CVE-2020-24512, and CVE-2020-24513 (#1962659, #1962709, #1962729, #1962675):
  • Addition of 06-55-05/0xb7 (CLX-SP A0) microcode at revision 0x3000010;
  • Addition of 06-6a-05/0x87 (ICX-SP C0) microcode at revision 0xc0002f0;
  • Addition of 06-6a-06/0x87 (ICX-SP D0) microcode at revision 0xd0002a0;
  • Addition of 06-86-04/0x01 (SNR B0) microcode at revision 0xb00000f;
  • Addition of 06-86-05/0x01 (SNR B1) microcode (in intel-ucode/06-86-04) at revision 0xb00000f;
  • Addition of 06-86-04/0x01 (SNR B0) microcode (in intel-ucode/06-86-05) at revision 0xb00000f;
  • Addition of 06-86-05/0x01 (SNR B1) microcode at revision 0xb00000f;
  • Addition of 06-8c-02/0xc2 (TGL-R C0) microcode at revision 0x16;
  • Addition of 06-8d-01/0xc2 (TGL-H R0) microcode at revision 0x2c;
  • Addition of 06-96-01/0x01 (EHL B1) microcode at revision 0x11;
  • Addition of 06-9c-00/0x01 (JSL A0/A1) microcode at revision 0x1d;
  • Addition of 06-a7-01/0x02 (RKL-S B0) microcode at revision 0x40;
  • Update of 06-4e-03/0xc0 (SKL-U/U 2+3e/Y D0/K1) microcode (in intel-06-4e-03/intel-ucode/06-4e-03) from revision 0xe2 up to 0xea;
  • Update of 06-4f-01/0xef (BDX-E/EP/EX/ML B0/M0/R0) microcode (in intel-06-4f-01/intel-ucode/06-4f-01) from revision 0xb000038 up to 0xb00003e;
  • Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006a0a up to 0x2006b06;
  • Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 N0/R0/S0) microcode (in intel-06-5e-03/intel-ucode/06-5e-03) from revision 0xe2 up to 0xea;
  • Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in intel-06-8c-01/intel-ucode/06-8c-01) from revision 0x68 up to 0x88;
  • Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xde up to 0xea;
  • Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xde up to 0xea;
  • Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0a) from revision 0xe0 up to 0xea;
  • Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0b) from revision 0xde up to 0xea;
  • Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from revision 0xde up to 0xea;
  • Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-09) from revision 0xde up to 0xea;
  • Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0a) from revision 0xde up to 0xea;
  • Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0b) from revision 0xde up to 0xea;
  • Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0c) from revision 0xde up to 0xea;
  • Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0xde up to 0xea;
  • Update of 06-3f-02/0x6f (HSX-E/EN/EP/EP 4S C0/C1/M1/R2) microcode from revision 0x44 up to 0x46;
  • Update of 06-3f-04/0x80 (HSX-EX E0) microcode from revision 0x16 up to 0x19;
  • Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000159 up to 0x100015b;
  • Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4003006 up to 0x4003102;
  • Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision 0x5003006 up to 0x5003102;
  • Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x700001e up…

• SECURITY UPDATE: New microcode data file 2021-06-08
  • New Microcodes: sig 0x00050655, pf_mask 0xb7, 2018-11-16, rev 0x3000010, size 47104 sig 0x000606a5, pf_mask 0x87, 2021-03-08, rev 0xc0002f0, size 283648 sig 0x000606a6, pf_mask 0x87, 2021-04-25, rev 0xd0002a0, size 283648 sig 0x00080664, pf_mask 0x01, 2021-02-17, rev 0xb00000f, size 130048 sig 0x00080665, pf_mask 0x01, 2021-02-17, rev 0xb00000f, size 130048 sig 0x000806c1, pf_mask 0x80, 2021-03-31, rev 0x0088, size 109568 sig 0x000806c2, pf_mask 0xc2, 2021-04-07, rev 0x0016, size 94208 sig 0x000806d1, pf_mask 0xc2, 2021-04-23, rev 0x002c, size 99328 sig 0x00090661, pf_mask 0x01, 2021-02-04, rev 0x0011, size 19456 sig 0x000906c0, pf_mask 0x01, 2021-03-23, rev 0x001d, size 19456 sig 0x000a0671, pf_mask 0x02, 2021-04-11, rev 0x0040, size 100352
  • Updated Microcodes: sig 0x000306f2, pf_mask 0x6f, 2021-01-27, rev 0x0046, size 34816 sig 0x000306f4, pf_mask 0x80, 2021-02-05, rev 0x0019, size 19456 sig 0x000406e3, pf_mask 0xc0, 2021-01-25, rev 0x00ea, size 105472 sig 0x000406f1, pf_mask 0xef, 2021-02-06, rev 0xb00003e, size 31744 sig 0x00050653, pf_mask 0x97, 2021-03-08, rev 0x100015b, size 34816 sig 0x00050654, pf_mask 0xb7, 2021-03-08, rev 0x2006b06, size 36864 sig 0x00050656, pf_mask 0xbf, 2021-03-08, rev 0x4003102, size 30720 sig 0x00050657, pf_mask 0xbf, 2021-03-08, rev 0x5003102, size 30720 sig 0x0005065b, pf_mask 0xbf, 2021-04-23, rev 0x7002302, size 27648 sig 0x00050663, pf_mask 0x10, 2021-02-04, rev 0x700001b, size 24576 sig 0x00050664, pf_mask 0x10, 2021-02-04, rev 0xf000019, size 24576 sig 0x00050665, pf_mask 0x10, 2021-02-04, rev 0xe000012, size 19456 sig 0x000506c9, pf_mask 0x03, 2020-10-23, rev 0x0044, size 17408 sig 0x000506ca, pf_mask 0x03, 2020-10-23, rev 0x0020, size 15360 sig 0x000506e3, pf_mask 0x36, 2021-01-25, rev 0x00ea, size 105472 sig 0x000506f1, pf_mask 0x01, 2020-10-23, rev 0x0034, size 11264 sig 0x000706a1, pf_mask 0x01, 2020-10-23, rev 0x0036, size 74752 sig 0x000706a8, pf_mask 0x01, 2020-10-23, rev 0x001a, size 75776 sig 0x000706e5, pf_mask 0x80, 2020-11-01, rev 0x00a6, size 110592 sig 0x000806a1, pf_mask 0x10, 2020-11-06, rev 0x002a, size 32768 sig 0x000806e9, pf_mask 0xc0, 2021-01-05, rev 0x00ea, size 104448 sig 0x000806e9, pf_mask 0x10, 2021-01-05, rev 0x00ea, size 104448 sig 0x000806ea, pf_mask 0xc0, 2021-01-06, rev 0x00ea, size 103424 sig 0x000806eb, pf_mask 0xd0, 2021-01-05, rev 0x00ea, size 104448 sig 0x000806ec, pf_mask 0x94, 2021-01-05, rev 0x00ea, size 104448 sig 0x000906e9, pf_mask 0x2a, 2021-01-05, rev 0x00ea, size 104448 sig 0x000906ea, pf_mask 0x22, 2021-01-05, rev 0x00ea, size 102400 sig 0x000906eb, pf_mask 0x02, 2021-01-05, rev 0x00ea, size 104448 sig 0x000906ec, pf_mask 0x22, 2021-01-05, rev 0x00ea, size 103424 sig 0x000906ed, pf_mask 0x22, 2021-01-05, rev 0x00ea, size 103424 sig 0x000a0652, pf_mask 0x20, 2021-02-07, rev 0x00ea, size 93184 sig 0x000a0653, pf_mask 0x22, 2021-03-08, rev 0x00ea, size 94208 sig 0x000a0655, pf_mask 0x22, 2021-03-08, rev 0x00ec, size 94208 sig 0x000a0660, pf_mask 0x80, 2020-12-08, rev 0x00e8, size 94208 sig 0x000a0661, pf_mask 0x80, 2021-02-07, rev 0x00ea, size 93184
  • CVE-2021-24489, INTEL-TA-00442
  • CVE-2020-24511, INTEL-TA-00464
  • CVE-2020-24512, INTEL-TA-00464
  • CVE-2020-24513, INTEL-TA-00465

Updated microcodes for Intel processors, fixing various functional issues, and at least the following security issues:

Incomplete cleanup in some Intel(R) VT-d products may allow an authenticated user to potentially enable escalation of privilege via local access (CVE-2020-24489).

Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access (CVE-2020-24511).

Domain-bypass transient execution vulnerability in some Intel Atom(R) Processors may allow an authenticated user to potentially enable information disclosure via local access (CVE-2020-24513).

For more info about this update, see the refenced links.

This update for ucode-intel fixes the following issues:

Updated to Intel CPU Microcode 20210608 release.

• CVE-2020-24513: A domain bypass transient execution vulnerability was discovered on some Intel Atom processors that use a micro-architectural incident channel. (INTEL-SA-00465 bsc#1179833)

  See also: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00465.html

• CVE-2020-24511: The IBRS feature to mitigate Spectre variant 2 transient execution side channel vulnerabilities may not fully prevent non-root (guest) branches from controlling the branch predictions of the root (host) (INTEL-SA-00464 bsc#1179836)

  See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html)

• CVE-2020-24512: Fixed trivial data value cache-lines such as all-zero value cache-lines may lead to changes in cache-allocation or write-back behavior for such cache-lines (bsc#1179837 INTEL-SA-00464)

  See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html)

• CVE-2020-24489: Fixed Intel VT-d device pass through potential local privilege escalation (INTEL-SA-00442 bsc#1179839)

  See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html

Other fixes:

• Update for functional issues. Refer to Third Generation Intel Xeon Processor Scalable Family Specification Updatefor details.

• Update for functional issues. Refer to Second Generation Intel Xeon Processor Scalable Family Specification Update for details.

• Update for functional issues. Refer to Intel Xeon Processor Scalable Family Specification Update for details.

• Update for functional issues. Refer to Intel Xeon Processor D-1500, D-1500 NS and D-1600 NS Spec Update for details.

• Update for functional issues. Refer to Intel Xeon E7-8800 and E7-4800 v3 Processor Specification Update for details.

• Update for functional issues. Refer to Intel Xeon Processor E5 v3 Product Family Specification Update for details.

• Update for functional issues. Refer to 10th Gen Intel Core Processor Families Specification Update for details.

• Update for functional issues. Refer to 8th and 9th Gen Intel Core Processor Family Spec Update for details.

• Update for functional issues. Refer to 7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update for details.

• Update for functional issues. Refer to 6th Gen Intel Processor Family Specification Update for details.

• Update for functional issues. Refer to Intel Xeon E3-1200 v6 Processor Family Specification Update for details.

• Update for functional issues. Refer to Intel Xeon E-2100 and E-2200 Processor Family Specification Update for details.

• New platforms:

| Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CLX-SP | A0 | 06-55-05/b7 | |…

This update for ucode-intel fixes the following issues:

Updated to Intel CPU Microcode 20210608 release.

• CVE-2020-24513: A domain bypass transient execution vulnerability was discovered on some Intel Atom processors that use a micro-architectural incident channel. (INTEL-SA-00465 bsc#1179833) See also: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00465.html

• CVE-2020-24511: The IBRS feature to mitigate Spectre variant 2 transient execution side channel vulnerabilities may not fully prevent non-root (guest) branches from controlling the branch predictions of the root (host) (INTEL-SA-00464 bsc#1179836)

  See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html)

• CVE-2020-24512: Fixed trivial data value cache-lines such as all-zero value cache-lines may lead to changes in cache-allocation or write-back behavior for such cache-lines (bsc#1179837 INTEL-SA-00464)

  See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html)

  • CVE-2020-24489: Fixed Intel VT-d device pass through potential local privilege escalation (INTEL-SA-00442 bsc#1179839)

    See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html

Other fixes:

• Update for functional issues. Refer to Third Generation Intel Xeon Processor Scalable Family Specification Updatefor details.

• Update for functional issues. Refer to Second Generation Intel Xeon Processor Scalable Family Specification Update for details.

• Update for functional issues. Refer to Intel Xeon Processor Scalable Family Specification Update for details.

• Update for functional issues. Refer to Intel Xeon Processor D-1500, D-1500 NS and D-1600 NS Spec Update for details.

• Update for functional issues. Refer to Intel Xeon E7-8800 and E7-4800 v3 Processor Specification Update for details.

• Update for functional issues. Refer to Intel Xeon Processor E5 v3 Product Family Specification Update for details.

• Update for functional issues. Refer to 10th Gen Intel Core Processor Families Specification Update for details.

• Update for functional issues. Refer to 8th and 9th Gen Intel Core Processor Family Spec Update for details.

• Update for functional issues. Refer to 7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update for details.

• Update for functional issues. Refer to 6th Gen Intel Processor Family Specification Update for details.

• Update for functional issues. Refer to Intel Xeon E3-1200 v6 Processor Family Specification Update for details.

• Update for functional issues. Refer to Intel Xeon E-2100 and E-2200 Processor Family Specification Update for details.

• New platforms:

| Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CLX-SP | A0 | 06-55-05/b7 | | 03000010 |…

These are all security issues fixed in the ucode-intel-20210608-1.2 package on the GA media of openSUSE Tumbleweed.

This update for microcode_ctl fixes the following issues:

Updated to Intel CPU Microcode 20210525 release:

• CVE-2020-24513: A domain bypass transient execution vulnerability was discovered on some Intel Atom processors that use a micro-architectural incident channel. (bsc#1179833)
• CVE-2020-24511: The IBRS feature to mitigate Spectre variant 2 transient execution side channel vulnerabilities may not fully prevent non-root (guest) branches from controlling the branch predictions of the root (host) (bsc#1179836)
• CVE-2020-24512: Fixed trivial data value cache-lines such as all-zero value cache-lines may lead to changes in cache-allocation or write-back behavior for such cache-lines (bsc#1179837)
• CVE-2020-24489: Fixed Intel VT-d device pass through potential local privilege escalation (bsc#1179839)

This update for ucode-intel fixes the following issues:

Updated to Intel CPU Microcode 20210608 release.

• CVE-2020-24513: A domain bypass transient execution vulnerability was discovered on some Intel Atom processors that use a micro-architectural incident channel. (INTEL-SA-00465 bsc#1179833) See also: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00465.html

• CVE-2020-24511: The IBRS feature to mitigate Spectre variant 2 transient execution side channel vulnerabilities may not fully prevent non-root (guest) branches from controlling the branch predictions of the root (host) (INTEL-SA-00464 bsc#1179836)

  See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html)

• CVE-2020-24512: Fixed trivial data value cache-lines such as all-zero value cache-lines may lead to changes in cache-allocation or write-back behavior for such cache-lines (bsc#1179837 INTEL-SA-00464)

  See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html)

• CVE-2020-24489: Fixed Intel VT-d device pass through potential local privilege escalation (INTEL-SA-00442 bsc#1179839)

  See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html

Other fixes:

• Update for functional issues. Refer to Third Generation Intel Xeon Processor Scalable Family Specification Updatefor details.

• Update for functional issues. Refer to Second Generation Intel Xeon Processor Scalable Family Specification Update for details.

• Update for functional issues. Refer to Intel Xeon Processor Scalable Family Specification Update for details.

• Update for functional issues. Refer to Intel Xeon Processor D-1500, D-1500 NS and D-1600 NS Spec Update for details.

• Update for functional issues. Refer to Intel Xeon E7-8800 and E7-4800 v3 Processor Specification Update for details.

• Update for functional issues. Refer to Intel Xeon Processor E5 v3 Product Family Specification Update for details.

• Update for functional issues. Refer to 10th Gen Intel Core Processor Families Specification Update for details.

• Update for functional issues. Refer to 8th and 9th Gen Intel Core Processor Family Spec Update for details.

• Update for functional issues. Refer to 7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update for details.

• Update for functional issues. Refer to 6th Gen Intel Processor Family Specification Update for details.

• Update for functional issues. Refer to Intel Xeon E3-1200 v6 Processor Family Specification Update for details.

• Update for functional issues. Refer to Intel Xeon E-2100 and E-2200 Processor Family Specification Update for details.

• New platforms:

| Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CLX-SP | A0 | 06-55-05/b7 | | 03000010 | Xeon…

This update for ucode-intel fixes the following issues:

Updated to Intel CPU Microcode 20210608 release.

• CVE-2020-24513: A domain bypass transient execution vulnerability was discovered on some Intel Atom processors that use a micro-architectural incident channel. (INTEL-SA-00465 bsc#1179833)

  See also: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00465.html

• CVE-2020-24511: The IBRS feature to mitigate Spectre variant 2 transient execution side channel vulnerabilities may not fully prevent non-root (guest) branches from controlling the branch predictions of the root (host) (INTEL-SA-00464 bsc#1179836)

  See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html)

• CVE-2020-24512: Fixed trivial data value cache-lines such as all-zero value cache-lines may lead to changes in cache-allocation or write-back behavior for such cache-lines (bsc#1179837 INTEL-SA-00464)

  See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html)

• CVE-2020-24489: Fixed Intel VT-d device pass through potential local privilege escalation (INTEL-SA-00442 bsc#1179839)

  See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html

Other fixes:

• Update for functional issues. Refer to Third Generation Intel Xeon Processor Scalable Family Specification Updatefor details.

• Update for functional issues. Refer to Second Generation Intel Xeon Processor Scalable Family Specification Update for details.

• Update for functional issues. Refer to Intel Xeon Processor Scalable Family Specification Update for details.

• Update for functional issues. Refer to Intel Xeon Processor D-1500, D-1500 NS and D-1600 NS Spec Update for details.

• Update for functional issues. Refer to Intel Xeon E7-8800 and E7-4800 v3 Processor Specification Update for details.

• Update for functional issues. Refer to Intel Xeon Processor E5 v3 Product Family Specification Update for details.

• Update for functional issues. Refer to 10th Gen Intel Core Processor Families Specification Update for details.

• Update for functional issues. Refer to 8th and 9th Gen Intel Core Processor Family Spec Update for details.

• Update for functional issues. Refer to 7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update for details.

• Update for functional issues. Refer to 6th Gen Intel Processor Family Specification Update for details.

• Update for functional issues. Refer to Intel Xeon E3-1200 v6 Processor Family Specification Update for details.

• Update for functional issues. Refer to Intel Xeon E-2100 and E-2200 Processor Family Specification Update for details.

• New platforms:

| Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CLX-SP | A0 | 06-55-05/b7 | | 03000010 | Xeon…

This update for ucode-intel fixes the following issues:

Updated to Intel CPU Microcode 20210608 release.

• CVE-2020-24513: A domain bypass transient execution vulnerability was discovered on some Intel Atom processors that use a micro-architectural incident channel. (INTEL-SA-00465 bsc#1179833)

  See also: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00465.html

• CVE-2020-24511: The IBRS feature to mitigate Spectre variant 2 transient execution side channel vulnerabilities may not fully prevent non-root (guest) branches from controlling the branch predictions of the root (host) (INTEL-SA-00464 bsc#1179836)

  See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html)

• CVE-2020-24512: Fixed trivial data value cache-lines such as all-zero value cache-lines may lead to changes in cache-allocation or write-back behavior for such cache-lines (bsc#1179837 INTEL-SA-00464)

  See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html)

• CVE-2020-24489: Fixed Intel VT-d device pass through potential local privilege escalation (INTEL-SA-00442 bsc#1179839)

  See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html

Other fixes:

• Update for functional issues. Refer to Third Generation Intel Xeon Processor Scalable Family Specification Updatefor details.

• Update for functional issues. Refer to Second Generation Intel Xeon Processor Scalable Family Specification Update for details.

• Update for functional issues. Refer to Intel Xeon Processor Scalable Family Specification Update for details.

• Update for functional issues. Refer to Intel Xeon Processor D-1500, D-1500 NS and D-1600 NS Spec Update for details.

• Update for functional issues. Refer to Intel Xeon E7-8800 and E7-4800 v3 Processor Specification Update for details.

• Update for functional issues. Refer to Intel Xeon Processor E5 v3 Product Family Specification Update for details.

• Update for functional issues. Refer to 10th Gen Intel Core Processor Families Specification Update for details.

• Update for functional issues. Refer to 8th and 9th Gen Intel Core Processor Family Spec Update for details.

• Update for functional issues. Refer to 7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update for details.

• Update for functional issues. Refer to 6th Gen Intel Processor Family Specification Update for details.

• Update for functional issues. Refer to Intel Xeon E3-1200 v6 Processor Family Specification Update for details.

• Update for functional issues. Refer to Intel Xeon E-2100 and E-2200 Processor Family Specification Update for details.

• New platforms:

| Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CLX-SP | A0 | 06-55-05/b7 | |…

This update for ucode-intel fixes the following issues:

• Updated to Intel CPU Microcode 20210525 release.

  • CVE-2020-24513: A domain bypass transient execution vulnerability was discovered on some Intel Atom processors that use a micro-architectural incident channel. (INTEL-SA-00465 bsc#1179833)

    See also: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00465.html

  • CVE-2020-24511: The IBRS feature to mitigate Spectre variant 2 transient execution side channel vulnerabilities may not fully prevent non-root (guest) branches from controlling the branch predictions of the root (host) (INTEL-SA-00464 bsc#1179836)

    See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html)

  • CVE-2020-24512: Fixed trivial data value cache-lines such as all-zero value cache-lines may lead to changes in cache-allocation or write-back behavior for such cache-lines (bsc#1179837 INTEL-SA-00464)

    See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html)

  • CVE-2020-24489: Fixed Intel VT-d device pass through potential local privilege escalation (INTEL-SA-00442 bsc#1179839)

    See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html

Other fixes:

• Update for functional issues. Refer to Third Generation Intel Xeon Processor Scalable Family Specification Updatefor details.

• Update for functional issues. Refer to Second Generation Intel Xeon Processor Scalable Family Specification Update for details.

• Update for functional issues. Refer to Intel Xeon Processor Scalable Family Specification Update for details.

• Update for functional issues. Refer to Intel Xeon Processor D-1500, D-1500 NS and D-1600 NS Spec Update for details.

• Update for functional issues. Refer to Intel Xeon E7-8800 and E7-4800 v3 Processor Specification Update for details.

• Update for functional issues. Refer to Intel Xeon Processor E5 v3 Product Family Specification Update for details.

• Update for functional issues. Refer to 10th Gen Intel Core Processor Families Specification Update for details.

• Update for functional issues. Refer to 8th and 9th Gen Intel Core Processor Family Spec Update for details.

• Update for functional issues. Refer to 7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update for details.

• Update for functional issues. Refer to 6th Gen Intel Processor Family Specification Update for details.

• Update for functional issues. Refer to Intel Xeon E3-1200 v6 Processor Family Specification Update for details.

• Update for functional issues. Refer to Intel Xeon E-2100 and E-2200 Processor Family Specification Update for details.

• New platforms:

| Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CLX-SP | A0 | 06-55-05/b7 | |…

This update for ucode-intel fixes the following issues:

Updated to Intel CPU Microcode 20210608 release.

• CVE-2020-24513: A domain bypass transient execution vulnerability was discovered on some Intel Atom processors that use a micro-architectural incident channel. (INTEL-SA-00465 bsc#1179833) See also: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00465.html

• CVE-2020-24511: The IBRS feature to mitigate Spectre variant 2 transient execution side channel vulnerabilities may not fully prevent non-root (guest) branches from controlling the branch predictions of the root (host) (INTEL-SA-00464 bsc#1179836)

  See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html)

• CVE-2020-24512: Fixed trivial data value cache-lines such as all-zero value cache-lines may lead to changes in cache-allocation or write-back behavior for such cache-lines (bsc#1179837 INTEL-SA-00464)

  See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html)

  • CVE-2020-24489: Fixed Intel VT-d device pass through potential local privilege escalation (INTEL-SA-00442 bsc#1179839)

    See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html

Other fixes:

• Update for functional issues. Refer to Third Generation Intel Xeon Processor Scalable Family Specification Updatefor details.

• Update for functional issues. Refer to Second Generation Intel Xeon Processor Scalable Family Specification Update for details.

• Update for functional issues. Refer to Intel Xeon Processor Scalable Family Specification Update for details.

• Update for functional issues. Refer to Intel Xeon Processor D-1500, D-1500 NS and D-1600 NS Spec Update for details.

• Update for functional issues. Refer to Intel Xeon E7-8800 and E7-4800 v3 Processor Specification Update for details.

• Update for functional issues. Refer to Intel Xeon Processor E5 v3 Product Family Specification Update for details.

• Update for functional issues. Refer to 10th Gen Intel Core Processor Families Specification Update for details.

• Update for functional issues. Refer to 8th and 9th Gen Intel Core Processor Family Spec Update for details.

• Update for functional issues. Refer to 7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update for details.

• Update for functional issues. Refer to 6th Gen Intel Processor Family Specification Update for details.

• Update for functional issues. Refer to Intel Xeon E3-1200 v6 Processor Family Specification Update for details.

• Update for functional issues. Refer to Intel Xeon E-2100 and E-2200 Processor Family Specification Update for details.

• New platforms:

| Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CLX-SP | A0 | 06-55-05/b7 | | 03000010 |…

It was discovered that some Intel processors may not properly invalidate cache entries used by Intel Virtualization Technology for Directed I/O (VT-d). This may allow a local user to perform a privilege escalation attack. (CVE-2020-24489)

Joseph Nuzman discovered that some Intel processors may not properly apply EIBRS mitigations (originally developed for CVE-2017-5715) and hence may allow unauthorized memory reads via sidechannel attacks. A local attacker could use this to expose sensitive information, including kernel memory. (CVE-2020-24511)

Travis Downs discovered that some Intel processors did not properly flush cache-lines for trivial-data values. This may allow an unauthorized user to infer the presence of these trivial-data-cache-lines via timing sidechannel attacks. A local attacker could use this to expose sensitive information. (CVE-2020-24512)

It was discovered that certain Intel Atom processors could expose memory contents stored in microarchitectural buffers. A local attacker could use this to expose sensitive information. (CVE-2020-24513)