CVE-2024-39279

The microcode_ctl packages provide microcode updates for Intel and AMD processors.

Security Fix(es):

• microcode_ctl: Improper input validation in UEFI firmware (CVE-2024-28047)

• microcode_ctl: Insufficient granularity of access control in UEFI firmware (CVE-2024-39279)

• microcode_ctl: mproper initialization in UEFI firmware OutOfBandXML module (CVE-2024-31157)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.

Insufficient granularity of access control in UEFI firmware in some Intel(R) processors may allow a authenticated user to potentially enable denial of service via local access.

The microcode_ctl packages provide microcode updates for Intel and AMD processors.

Security Fix(es):

• microcode_ctl: Improper input validation in UEFI firmware (CVE-2024-28047)
• microcode_ctl: Insufficient granularity of access control in UEFI firmware (CVE-2024-39279)
• microcode_ctl: mproper initialization in UEFI firmware OutOfBandXML module (CVE-2024-31157)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.

• New microcode update packages from upstream up to 2025-02-11:
  • New microcodes: sig 0x000a06f3, pf_mask 0x01, 2024-11-22, rev 0x3000330, size 1533952 sig 0x000b0674, pf_mask 0x32, 2024-09-25, rev 0x012c, size 211968 sig 0x000b06f6, pf_mask 0x07, 2024-08-01, rev 0x0038, size 225280 sig 0x000b06f7, pf_mask 0x07, 2024-08-01, rev 0x0038, size 225280
  • Updated microcodes: sig 0x000606a6, pf_mask 0x87, 2024-08-02, rev 0xd0003f5, size 308224 sig 0x000606c1, pf_mask 0x10, 2024-08-08, rev 0x10002c0, size 300032 sig 0x000806f4, pf_mask 0x10, 2024-07-30, rev 0x2c0003e0, size 622592 sig 0x000806f4, pf_mask 0x87, 2024-07-30, rev 0x2b000620, size 589824 sig 0x000806f5, pf_mask 0x10, 2024-07-30, rev 0x2c0003e0, size 622592 sig 0x000806f5, pf_mask 0x87, 2024-07-30, rev 0x2b000620, size 589824 sig 0x000806f6, pf_mask 0x10, 2024-07-30, rev 0x2c0003e0, size 622592 sig 0x000806f6, pf_mask 0x87, 2024-07-30, rev 0x2b000620, size 589824 sig 0x000806f7, pf_mask 0x87, 2024-07-30, rev 0x2b000620, size 589824 sig 0x000806f8, pf_mask 0x10, 2024-07-30, rev 0x2c0003e0, size 622592 sig 0x000806f8, pf_mask 0x87, 2024-07-30, rev 0x2b000620, size 589824 sig 0x00090672, pf_mask 0x07, 2024-08-01, rev 0x0038, size 225280 sig 0x00090675, pf_mask 0x07, 2024-08-01, rev 0x0038, size 225280 sig 0x000906a3, pf_mask 0x80, 2024-08-01, rev 0x0436, size 223232 sig 0x000906a4, pf_mask 0x40, 2024-07-29, rev 0x0009, size 119808 sig 0x000906a4, pf_mask 0x80, 2024-08-01, rev 0x0436, size 223232 sig 0x000906ea, pf_mask 0x22, 2024-07-28, rev 0x00fa, size 105472 sig 0x000906ed, pf_mask 0x22, 2024-07-31, rev 0x0102, size 106496 sig 0x000a0671, pf_mask 0x02, 2024-08-01, rev 0x0063, size 108544 sig 0x000b0671, pf_mask 0x32, 2024-09-25, rev 0x012c, size 211968 sig 0x000b06a2, pf_mask 0xe0, 2024-07-31, rev 0x4124, size 220160 sig 0x000b06a3, pf_mask 0xe0, 2024-07-31, rev 0x4124, size 220160 sig 0x000b06a8, pf_mask 0xe0, 2024-07-31, rev 0x4124, size 220160 sig 0x000b06e0, pf_mask 0x19, 2024-09-06, rev 0x001c, size 138240 sig 0x000b06f2, pf_mask 0x07, 2024-08-01, rev 0x0038, size 225280 sig 0x000b06f5, pf_mask 0x07, 2024-08-01, rev 0x0038, size 225280 sig 0x000c06f1, pf_mask 0x87, 2024-07-30, rev 0x21000291, size 560128 sig 0x000c06f2, pf_mask 0x87, 2024-07-30, rev 0x21000291, size 560128
• SECURITY UPDATE:
  • CVE-2024-31068 (INTEL-SA-01166)
  • CVE-2024-36293 (INTEL-SA-01213)
  • CVE-2024-39279 (INTEL-SA-01139)

• New microcode update packages from upstream up to 2025-02-11:
  • New microcodes: sig 0x000a06f3, pf_mask 0x01, 2024-11-22, rev 0x3000330, size 1533952 sig 0x000b0674, pf_mask 0x32, 2024-09-25, rev 0x012c, size 211968 sig 0x000b06f6, pf_mask 0x07, 2024-08-01, rev 0x0038, size 225280 sig 0x000b06f7, pf_mask 0x07, 2024-08-01, rev 0x0038, size 225280
  • Updated microcodes: sig 0x000606a6, pf_mask 0x87, 2024-08-02, rev 0xd0003f5, size 308224 sig 0x000606c1, pf_mask 0x10, 2024-08-08, rev 0x10002c0, size 300032 sig 0x000806f4, pf_mask 0x10, 2024-07-30, rev 0x2c0003e0, size 622592 sig 0x000806f4, pf_mask 0x87, 2024-07-30, rev 0x2b000620, size 589824 sig 0x000806f5, pf_mask 0x10, 2024-07-30, rev 0x2c0003e0, size 622592 sig 0x000806f5, pf_mask 0x87, 2024-07-30, rev 0x2b000620, size 589824 sig 0x000806f6, pf_mask 0x10, 2024-07-30, rev 0x2c0003e0, size 622592 sig 0x000806f6, pf_mask 0x87, 2024-07-30, rev 0x2b000620, size 589824 sig 0x000806f7, pf_mask 0x87, 2024-07-30, rev 0x2b000620, size 589824 sig 0x000806f8, pf_mask 0x10, 2024-07-30, rev 0x2c0003e0, size 622592 sig 0x000806f8, pf_mask 0x87, 2024-07-30, rev 0x2b000620, size 589824 sig 0x00090672, pf_mask 0x07, 2024-08-01, rev 0x0038, size 225280 sig 0x00090675, pf_mask 0x07, 2024-08-01, rev 0x0038, size 225280 sig 0x000906a3, pf_mask 0x80, 2024-08-01, rev 0x0436, size 223232 sig 0x000906a4, pf_mask 0x40, 2024-07-29, rev 0x0009, size 119808 sig 0x000906a4, pf_mask 0x80, 2024-08-01, rev 0x0436, size 223232 sig 0x000906ea, pf_mask 0x22, 2024-07-28, rev 0x00fa, size 105472 sig 0x000906ed, pf_mask 0x22, 2024-07-31, rev 0x0102, size 106496 sig 0x000a0671, pf_mask 0x02, 2024-08-01, rev 0x0063, size 108544 sig 0x000b0671, pf_mask 0x32, 2024-09-25, rev 0x012c, size 211968 sig 0x000b06a2, pf_mask 0xe0, 2024-07-31, rev 0x4124, size 220160 sig 0x000b06a3, pf_mask 0xe0, 2024-07-31, rev 0x4124, size 220160 sig 0x000b06a8, pf_mask 0xe0, 2024-07-31, rev 0x4124, size 220160 sig 0x000b06e0, pf_mask 0x19, 2024-09-06, rev 0x001c, size 138240 sig 0x000b06f2, pf_mask 0x07, 2024-08-01, rev 0x0038, size 225280 sig 0x000b06f5, pf_mask 0x07, 2024-08-01, rev 0x0038, size 225280 sig 0x000c06f1, pf_mask 0x87, 2024-07-30, rev 0x21000291, size 560128 sig 0x000c06f2, pf_mask 0x87, 2024-07-30, rev 0x21000291, size 560128
• SECURITY UPDATE:
  • CVE-2024-31068 (INTEL-SA-01166)
  • CVE-2024-36293 (INTEL-SA-01213)
  • CVE-2024-39279 (INTEL-SA-01139)

• Update Intel CPU microcode to 20250812, addresses: CVE-2024-28047, CVE-2024-31157, CVE-2024-39279, CVE-2024-28956, CVE-2024-43420, CVE-2024-45332, CVE-2025-24495, CVE-2025-20623, CVE-2025-20012
  • Addition of cpuid:806F8/0x10 (SPR-HBM B3) microcode (in microcode.dat) at revision 0x2c000401;
  • Addition of cpuid:806F8/0x87 (SPR-SP E5/S3) microcode (in microcode.dat) at revision 0x2b000643;
  • Addition of cpuid:90672/0x07 (ADL-HX/S 8+8 C0) microcode (in microcode.dat) at revision 0x3a;
  • Addition of cpuid:906A3/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in microcode.dat) at revision 0x437;
  • Addition of cpuid:A06D1/0x20 (GNR-AP/SP H0) microcode (in microcode.dat) at revision 0xa000100;
  • Addition of cpuid:A06D1/0x95 (GNR-AP/SP B0) microcode (in microcode.dat) at revision 0x10003d0;
  • Addition of cpuid:B0650/0x80 (ARL-U A1) microcode (in microcode.dat) at revision 0xa;
  • Addition of cpuid:B0671/0x32 (RPL-S B0) microcode (in microcode.dat) at revision 0x12f;
  • Addition of cpuid:B06A2/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in microcode.dat) at revision 0x4129;
  • Addition of cpuid:B06D1/0x80 (LNL B0) microcode (in microcode.dat) at revision 0x123;
  • Addition of cpuid:C0652/0x82 (ARL-H A1) microcode (in microcode.dat) at revision 0x119;
  • Addition of cpuid:C0662/0x82 (ARL-HX 8P/S B0) microcode (in microcode.dat) at revision 0x119;
  • Addition of cpuid:C0664/0x82 microcode (in microcode.dat) at revision 0x119;
  • Addition of cpuid:C06A2/0x82 microcode (in microcode.dat) at revision 0x119;
  • Addition of cpuid:C06F2/0x87 (EMR-SP A1) microcode (in microcode.dat) at revision 0x210002b3;
  • Removal of cpuid:50656/0xbf (CLX-SP B0) microcode (in microcode.dat) at revision 0x4003605;
  • Removal of cpuid:806F8/0x10 (SPR-HBM B3) microcode (in microcode.dat) at revision 0x2c0003e0;
  • Removal of cpuid:806F8/0x87 (SPR-SP E5/S3) microcode (in microcode.dat) at revision 0x2b000620;
  • Removal of cpuid:90672/0x07 (ADL-HX/S 8+8 C0) microcode (in microcode.dat) at revision 0x38;
  • Removal of cpuid:906A3/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in microcode.dat) at revision 0x436;
  • Removal of cpuid:B0671/0x32 (RPL-S B0) microcode (in microcode.dat) at revision 0x12c;
  • Removal of cpuid:B06A2/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in microcode.dat) at revision 0x4124;
  • Removal of cpuid:C06F1/0x87 (EMR-SP A0) microcode (in microcode.dat) at revision 0x21000291;
  • Removal of cpuid:C06F2/0x87 (EMR-SP A1) microcode (in microcode.dat) at revision 0x21000291;
  • Update of cpuid:50657/0xbf (CLX-SP/W/X B1/L1) microcode (in microcode.dat) from revision 0x5003707 up to 0x5003901;
  • Update of cpuid:5065B/0xbf (CPX-SP A1) microcode (in microcode.dat) from revision 0x7002904 up to 0x7002b01;
  • Update of cpuid:606A6/0x87 (ICX-SP D0) microcode (in microcode.dat) from revision 0xd0003f5 up to 0xd000410;
  • Update of cpuid:606C1/0x10 (ICL-D B0) microcode (in microcode.dat) from revision 0x10002c0 up to 0x10002e0;
  • Update of cpuid:706A8/0x01 (GLK-R R0) microcode (in microcode.dat) from revision 0x24 up to 0x26;
  • Update of cpuid:706E5/0x80 (ICL-U/Y D1) microcode (in microcode.dat) from revision 0xc6 up to 0xca;
  • Update of cpuid:806C1/0x80 (TGL-UP3/UP4 B1) microcode (in microcode.dat) from revision 0xb8 up to 0xbc;
  • Update of cpuid:806C2/0xc2 (TGL-R C0) microcode (in microcode.dat) from revision 0x38 up to 0x3c;
  • Update of cpuid:806D1/0xc2 (TGL-H R0) microcode (in microcode.dat) from revision 0x52 up to 0x56;
  • Update of cpuid:806EC/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0) microcode (in microcode.dat) from revision 0xfc up to 0x100;
  • Update of cpuid:806F4/0x10 microcode (in microcode.dat) from revision 0x2c0003e0 up to 0x2c000401;
  • Update of cpuid:806F4/0x87 (SPR-SP E0/S1) microcode (in microcode.dat) from revision 0x2b000620 up to 0x2b000643;
  • Update of…

Insufficient granularity of access control in UEFI firmware in some Intel(R) processors may allow a authenticated user to potentially enable denial of service via local access.

Ke Sun, Paul Grosen and Alyssa Milburn discovered that some Intel® Processors did not properly implement Finite State Machines (FSMs) in Hardware Logic. A local privileged attacker could use this issue to cause a denial of service. (CVE-2024-31068)

It was discovered that some Intel® Processors with Intel® SGX did not properly restrict access to the EDECCSSA user leaf function. A local authenticated attacker could use this issue to cause a denial of service. (CVE-2024-36293)

Ke Sun, Alyssa Milburn, Benoit Morgan, and Erik Bjorge discovered that the UEFI firmware for some Intel® processors did not properly restrict access. An authenticated local attacker could use this issue to cause a denial of service. (CVE-2024-39279)

USN-7269-1 fixed vulnerabilities in Intel Microcode. This update provides the corresponding updates for Ubuntu 24.04 LTS.

Original advisory details:

Ke Sun, Paul Grosen and Alyssa Milburn discovered that some Intel® Processors did not properly implement Finite State Machines (FSMs) in Hardware Logic. A local privileged attacker could use this issue to cause a denial of service. (CVE-2024-31068)

It was discovered that some Intel® Processors with Intel® SGX did not properly restrict access to the EDECCSSA user leaf function. A local authenticated attacker could use this issue to cause a denial of service. (CVE-2024-36293)

Ke Sun, Alyssa Milburn, Benoit Morgan, and Erik Bjorge discovered that the UEFI firmware for some Intel® processors did not properly restrict access. An authenticated local attacker could use this issue to cause a denial of service. (CVE-2024-39279)