Vulnerabilities > CVE-2020-0548 - Improper Resource Shutdown or Release vulnerability in Intel products
Attack vector
LOCAL Attack complexity
LOW Privileges required
LOW Confidentiality impact
HIGH Integrity impact
NONE Availability impact
NONE Summary
Cleanup errors in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Flooding An attacker consumes the resources of a target by rapidly engaging in a large number of interactions with the target. This type of attack generally exposes a weakness in rate limiting or flow control in management of interactions. Since each request consumes some of the target's resources, if a sufficiently large number of requests must be processed at the same time then the target's resources can be exhausted. The degree to which the attack is successful depends upon the volume of requests in relation to the amount of the resource the target has access to, and other mitigating circumstances such as the target's ability to shift load or acquired additional resources to deal with the depletion. The more protected the resource and the greater the quantity of it that must be consumed, the more resources the attacker may need to have at their disposal. A typical TCP/IP flooding attack is a Distributed Denial-of-Service attack where many machines simultaneously make a large number of requests to a target. Against a target with strong defenses and a large pool of resources, many tens of thousands of attacking machines may be required. When successful this attack prevents legitimate users from accessing the service and can cause the target to crash. This attack differs from resource depletion through leaks or allocations in that the latter attacks do not rely on the volume of requests made to the target but instead focus on manipulation of the target's operations. The key factor in a flooding attack is the number of requests the attacker can make in a given period of time. The greater this number, the more likely an attack is to succeed against a given target.
- Excessive Allocation An attacker causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources. This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request. For example, using an Integer Attack, the attacker could cause a variable that controls allocation for a request to hold an excessively large value. Excessive allocation of resources can render a service degraded or unavailable to legitimate users and can even lead to crashing of the target.
- Resource Leak Exposure An attacker utilizes a resource leak on the target to deplete the quantity of the resource available to service legitimate requests. Resource leaks most often come in the form of memory leaks where memory is allocated but never released after it has served its purpose, however, theoretically, any other resource that can be reserved can be targeted if the target fails to release the reservation when the reserved resource block is no longer needed. In this attack, the attacker determines what activity results in leaked resources and then triggers that activity on the target. Since some leaks may be small, this may require a large number of requests by the attacker. However, this attack differs from a flooding attack in that the rate of requests is generally not significant. This is because the lost resources due to the leak accumulate until the target is reset, usually by restarting it. Thus, a resource-poor attacker who would be unable to flood the target can still utilize this attack. Resource depletion through leak differs from resource depletion through allocation in that, in the former, the attacker may not be able to control the size of each leaked allocation, but instead allows the leak to accumulate until it is large enough to affect the target's performance. When depleting resources through allocation, the allocated resource may eventually be released by the target so the attack relies on making sure that the allocation size itself is prohibitive of normal operations by the target.
Nessus
NASL family Debian Local Security Checks NASL id DEBIAN_DSA-4701.NASL description This update ships updated CPU microcode for some types of Intel CPUs and provides mitigations for the Special Register Buffer Data Sampling (CVE-2020-0543 ), Vector Register Sampling (CVE-2020-0548 ) and L1D Eviction Sampling (CVE-2020-0549 ) hardware vulnerabilities. The microcode update for HEDT and Xeon CPUs with signature 0x50654 which was reverted in DSA 4565-2 is now included again with a fixed release. The upstream update for Skylake-U/Y (signature 0x406e3) had to be excluded from this update due to reported hangs on boot. For details refer to https://www.intel.com/content/www/us/en/security-center/advisory/intel -sa-00320.html, https://www.intel.com/content/www/us/en/security-center/advisory/intel -sa-00329.html last seen 2020-06-13 modified 2020-06-12 plugin id 137374 published 2020-06-12 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/137374 title Debian DSA-4701-1 : intel-microcode - security update code # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Debian Security Advisory DSA-4701. The text # itself is copyright (C) Software in the Public Interest, Inc. # include("compat.inc"); if (description) { script_id(137374); script_version("1.2"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/18"); script_cve_id("CVE-2020-0543", "CVE-2020-0548", "CVE-2020-0549"); script_xref(name:"DSA", value:"4701"); script_name(english:"Debian DSA-4701-1 : intel-microcode - security update"); script_summary(english:"Checks dpkg output for the updated package"); script_set_attribute( attribute:"synopsis", value:"The remote Debian host is missing a security-related update." ); script_set_attribute( attribute:"description", value: "This update ships updated CPU microcode for some types of Intel CPUs and provides mitigations for the Special Register Buffer Data Sampling (CVE-2020-0543 ), Vector Register Sampling (CVE-2020-0548 ) and L1D Eviction Sampling (CVE-2020-0549 ) hardware vulnerabilities. The microcode update for HEDT and Xeon CPUs with signature 0x50654 which was reverted in DSA 4565-2 is now included again with a fixed release. The upstream update for Skylake-U/Y (signature 0x406e3) had to be excluded from this update due to reported hangs on boot. For details refer to https://www.intel.com/content/www/us/en/security-center/advisory/intel -sa-00320.html, https://www.intel.com/content/www/us/en/security-center/advisory/intel -sa-00329.html" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2020-0543" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2020-0548" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2020-0549" ); # https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00320.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?c444b53b" ); # https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00329.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?8a852169" ); # https://security-tracker.debian.org/tracker/source-package/intel-microcode script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?019586d4" ); script_set_attribute( attribute:"see_also", value:"https://packages.debian.org/source/stretch/intel-microcode" ); script_set_attribute( attribute:"see_also", value:"https://packages.debian.org/source/buster/intel-microcode" ); script_set_attribute( attribute:"see_also", value:"https://www.debian.org/security/2020/dsa-4701" ); script_set_attribute( attribute:"solution", value: "Upgrade the intel-microcode packages. For the oldstable distribution (stretch), these problems have been fixed in version 3.20200609.2~deb9u1. For the stable distribution (buster), these problems have been fixed in version 3.20200609.2~deb10u1." ); script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:intel-microcode"); script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:10.0"); script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:9.0"); script_set_attribute(attribute:"vuln_publication_date", value:"2020/01/28"); script_set_attribute(attribute:"patch_publication_date", value:"2020/06/11"); script_set_attribute(attribute:"plugin_publication_date", value:"2020/06/12"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Debian Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l"); exit(0); } include("audit.inc"); include("debian_package.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian"); if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (deb_check(release:"10.0", prefix:"intel-microcode", reference:"3.20200609.2~deb10u1")) flag++; if (deb_check(release:"9.0", prefix:"intel-microcode", reference:"3.20200609.2~deb9u1")) flag++; if (flag) { if (report_verbosity > 0) security_note(port:0, extra:deb_report_get()); else security_note(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2020-2431.NASL description From Red Hat Security Advisory 2020:2431 : The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2431 advisory. - hw: Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543) - hw: Vector Register Data Sampling (CVE-2020-0548) - hw: L1D Cache Eviction Sampling (CVE-2020-0549) Note that Nessus has not tested for this issue but has instead relied only on the application last seen 2020-06-13 modified 2020-06-12 plugin id 137385 published 2020-06-12 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/137385 title Oracle Linux 8 : microcode_ctl (ELSA-2020-2431) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-4385-1.NASL description It was discovered that memory contents previously stored in microarchitectural special registers after RDRAND, RDSEED, and SGX EGETKEY read operations on Intel client and Xeon E3 processors may be briefly exposed to processes on the same or different processor cores. A local attacker could use this to expose sensitive information. (CVE-2020-0543) It was discovered that on some Intel processors, partial data values previously read from a vector register on a physical core may be propagated into unused portions of the store buffer. A local attacker could possible use this to expose sensitive information. (CVE-2020-0548) It was discovered that on some Intel processors, data from the most recently evicted modified L1 data cache (L1D) line may be propagated into an unused (invalid) L1D fill buffer. A local attacker could possibly use this to expose sensitive information. (CVE-2020-0549). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-13 modified 2020-06-10 plugin id 137295 published 2020-06-10 reporter Ubuntu Security Notice (C) 2020 Canonical, Inc. / NASL script (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/137295 title Ubuntu 16.04 LTS / 18.04 LTS / 19.10 / 20.04 : intel-microcode vulnerabilities (USN-4385-1) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2020-2432.NASL description The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2432 advisory. - hw: Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543) - hw: Vector Register Data Sampling (CVE-2020-0548) - hw: L1D Cache Eviction Sampling (CVE-2020-0549) Note that Nessus has not tested for this issue but has instead relied only on the application last seen 2020-06-12 modified 2020-06-10 plugin id 137313 published 2020-06-10 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/137313 title RHEL 7 : microcode_ctl (RHSA-2020:2432) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2020-2433.NASL description The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2433 advisory. - hw: Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543) - hw: Vector Register Data Sampling (CVE-2020-0548) - hw: L1D Cache Eviction Sampling (CVE-2020-0549) Note that Nessus has not tested for this issue but has instead relied only on the application last seen 2020-06-12 modified 2020-06-11 plugin id 137338 published 2020-06-11 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/137338 title CentOS 6 : microcode_ctl (CESA-2020:2433) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2020-2433.NASL description The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2433 advisory. - hw: Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543) - hw: Vector Register Data Sampling (CVE-2020-0548) - hw: L1D Cache Eviction Sampling (CVE-2020-0549) Note that Nessus has not tested for this issue but has instead relied only on the application last seen 2020-06-12 modified 2020-06-09 plugin id 137273 published 2020-06-09 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/137273 title RHEL 6 : microcode_ctl (RHSA-2020:2433) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2020-2431.NASL description The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2431 advisory. - hw: Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543) - hw: Vector Register Data Sampling (CVE-2020-0548) - hw: L1D Cache Eviction Sampling (CVE-2020-0549) Note that Nessus has not tested for this issue but has instead relied only on the application last seen 2020-06-12 modified 2020-06-09 plugin id 137276 published 2020-06-09 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/137276 title RHEL 8 : microcode_ctl (RHSA-2020:2431) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2020-2432.NASL description The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2432 advisory. - hw: Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543) - hw: Vector Register Data Sampling (CVE-2020-0548) - hw: L1D Cache Eviction Sampling (CVE-2020-0549) Note that Nessus has not tested for this issue but has instead relied only on the application last seen 2020-06-12 modified 2020-06-11 plugin id 137337 published 2020-06-11 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/137337 title CentOS 7 : microcode_ctl (CESA-2020:2432) NASL family SuSE Local Security Checks NASL id OPENSUSE-2020-791.NASL description This update for ucode-intel fixes the following issues : Updated Intel CPU Microcode to 20200602 (prerelease) (bsc#1172466) This update contains security mitigations for : - CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This attack is known as Special Register Buffer Data Sampling (SRBDS) or last seen 2020-06-12 modified 2020-06-11 plugin id 137351 published 2020-06-11 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/137351 title openSUSE Security Update : ucode-intel (openSUSE-2020-791) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-4385-2.NASL description USN-4385-1 provided updated Intel Processor Microcode. Unfortunately, that update prevented certain processors in the Intel Skylake family (06_4EH) from booting successfully. Additonally, on Ubuntu 20.04 LTS, late loading of microcode was enabled, which could lead to system instability. This update reverts the microcode update for the Skylake processor family and disables the late loading option on Ubuntu 20.04 LTS. Please note that the last seen 2020-06-12 modified 2020-06-11 plugin id 137352 published 2020-06-11 reporter Ubuntu Security Notice (C) 2020 Canonical, Inc. / NASL script (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/137352 title Ubuntu 16.04 LTS / 18.04 LTS / 19.10 / 20.04 : intel-microcode regression (USN-4385-2) NASL family Scientific Linux Local Security Checks NASL id SL_20200610_MICROCODE_CTL_ON_SL6_X.NASL description Security Fix(es) : - hw: Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543) - hw: L1D Cache Eviction Sampling (CVE-2020-0549) - hw: Vector Register Data Sampling (CVE-2020-0548) last seen 2020-06-12 modified 2020-06-11 plugin id 137348 published 2020-06-11 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/137348 title Scientific Linux Security Update : microcode_ctl on SL6.x i386/x86_64 (20200610)
Redhat
| rpms |
|
References
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00329.html
- https://security.netapp.com/advisory/ntap-20200210-0004/
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00016.html
- https://www.debian.org/security/2020/dsa-4701
- https://lists.debian.org/debian-lts-announce/2020/06/msg00019.html
- https://usn.ubuntu.com/4385-1/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T5OUM24ZC43G4IDT3JUCIHJTSDXJSK6Y/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DT2VKDMQ3I37NBNJ256A2EXR7OJHXXKZ/