USN-4985-1: Intel Microcode vulnerabilities | Cloud Foundry

Severity

High

Vendor

Canonical Ubuntu

Versions Affected

• Canonical Ubuntu 14.04
• Canonical Ubuntu 16.04
• Canonical Ubuntu 18.04

Description

It was discovered that some Intel processors may not properly invalidate cache entries used by Intel Virtualization Technology for Directed I/O (VT-d). This may allow a local user to perform a privilege escalation attack. (CVE-2021-24489)

Joseph Nuzman discovered that some Intel processors may not properly apply EIBRS mitigations (originally developed for CVE-2017-5715) and hence may allow unauthorized memory reads via sidechannel attacks. A local attacker could use this to expose sensitive information, including kernel memory. (CVE-2020-24511)

Travis Downs discovered that some Intel processors did not properly flush cache-lines for trivial-data values. This may allow an unauthorized user to infer the presence of these trivial-data-cache-lines via timing sidechannel attacks. A local attacker could use this to expose sensitive information. (CVE-2020-24512)

It was discovered that certain Intel Atom processors could expose memory contents stored in microarchitectural buffers. A local attacker could use this to expose sensitive information. (CVE-2020-24513)

CVEs contained in this USN include: CVE-2020-24512, CVE-2021-24489, CVE-2020-24513, CVE-2020-24511.

Affected Cloud Foundry Products and Versions

Severity is high unless otherwise noted.

• Bionic Stemcells
  • 1.x versions prior to 1.10
  • All other stemcells not listed.

Mitigation

Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:

• Bionic Stemcells
  • Upgrade 1.x versions to 1.10 or greater
  • All other stemcells should be upgraded to the latest version available on bosh.io.

References

• USN Notice
• CVE-2020-24512
• CVE-2021-24489
• CVE-2020-24513
• CVE-2020-24511

History

2021-06-11: Initial vulnerability report published.