SB2024082040 - SUSE update for ucode-intel

Description

This security bulletin contains information about 5 secuirty vulnerabilities.

1) Improper isolation or compartmentalization (CVE-ID: CVE-2023-42667)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper isolation in the Intel Core Ultra Processor stream cache mechanism. A local user can execute arbitrary code with elevated privileges.

2) Improper isolation or compartmentalization (CVE-ID: CVE-2023-49141)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to an improper isolation in some Intel Processors stream cache mechanism. A local user can execute arbitrary code with elevated privileges.

3) Incorrect behavior order (CVE-ID: CVE-2024-24853)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to an incorrect behavior order in SMI Transfer monitor (STM). A local user can escalate privileges on the system.

4) Protection Mechanism Failure (CVE-ID: CVE-2024-24980)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insufficient implementation of security measures. A local privileged user can escalate privileges on the system.

5) Resource management error (CVE-ID: CVE-2024-25939)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application. Mirrored regions with different values in 3rd Generation Intel Xeon Scalable Processors may allow a local privileged user to crash the system.

Remediation

Install update from vendor's website.

References

• https://www.suse.com/support/update/announcement/2024/suse-su-20242941-1/