Vulnerabilities > CVE-2020-0548 - Improper Resource Shutdown or Release vulnerability in Intel products

047910
CVSS 5.5 - MEDIUM
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
LOW
Confidentiality impact
HIGH
Integrity impact
NONE
Availability impact
NONE
local
low complexity
intel
CWE-404
nessus

Summary

Cleanup errors in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

Vulnerable Configurations

Part Description Count
OS
Intel
427
Hardware
Intel
427

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Flooding
    An attacker consumes the resources of a target by rapidly engaging in a large number of interactions with the target. This type of attack generally exposes a weakness in rate limiting or flow control in management of interactions. Since each request consumes some of the target's resources, if a sufficiently large number of requests must be processed at the same time then the target's resources can be exhausted. The degree to which the attack is successful depends upon the volume of requests in relation to the amount of the resource the target has access to, and other mitigating circumstances such as the target's ability to shift load or acquired additional resources to deal with the depletion. The more protected the resource and the greater the quantity of it that must be consumed, the more resources the attacker may need to have at their disposal. A typical TCP/IP flooding attack is a Distributed Denial-of-Service attack where many machines simultaneously make a large number of requests to a target. Against a target with strong defenses and a large pool of resources, many tens of thousands of attacking machines may be required. When successful this attack prevents legitimate users from accessing the service and can cause the target to crash. This attack differs from resource depletion through leaks or allocations in that the latter attacks do not rely on the volume of requests made to the target but instead focus on manipulation of the target's operations. The key factor in a flooding attack is the number of requests the attacker can make in a given period of time. The greater this number, the more likely an attack is to succeed against a given target.
  • Excessive Allocation
    An attacker causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources. This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request. For example, using an Integer Attack, the attacker could cause a variable that controls allocation for a request to hold an excessively large value. Excessive allocation of resources can render a service degraded or unavailable to legitimate users and can even lead to crashing of the target.
  • Resource Leak Exposure
    An attacker utilizes a resource leak on the target to deplete the quantity of the resource available to service legitimate requests. Resource leaks most often come in the form of memory leaks where memory is allocated but never released after it has served its purpose, however, theoretically, any other resource that can be reserved can be targeted if the target fails to release the reservation when the reserved resource block is no longer needed. In this attack, the attacker determines what activity results in leaked resources and then triggers that activity on the target. Since some leaks may be small, this may require a large number of requests by the attacker. However, this attack differs from a flooding attack in that the rate of requests is generally not significant. This is because the lost resources due to the leak accumulate until the target is reset, usually by restarting it. Thus, a resource-poor attacker who would be unable to flood the target can still utilize this attack. Resource depletion through leak differs from resource depletion through allocation in that, in the former, the attacker may not be able to control the size of each leaked allocation, but instead allows the leak to accumulate until it is large enough to affect the target's performance. When depleting resources through allocation, the allocated resource may eventually be released by the target so the attack relies on making sure that the allocation size itself is prohibitive of normal operations by the target.

Nessus

  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-4701.NASL
    descriptionThis update ships updated CPU microcode for some types of Intel CPUs and provides mitigations for the Special Register Buffer Data Sampling (CVE-2020-0543 ), Vector Register Sampling (CVE-2020-0548 ) and L1D Eviction Sampling (CVE-2020-0549 ) hardware vulnerabilities. The microcode update for HEDT and Xeon CPUs with signature 0x50654 which was reverted in DSA 4565-2 is now included again with a fixed release. The upstream update for Skylake-U/Y (signature 0x406e3) had to be excluded from this update due to reported hangs on boot. For details refer to https://www.intel.com/content/www/us/en/security-center/advisory/intel -sa-00320.html, https://www.intel.com/content/www/us/en/security-center/advisory/intel -sa-00329.html
    last seen2020-06-13
    modified2020-06-12
    plugin id137374
    published2020-06-12
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/137374
    titleDebian DSA-4701-1 : intel-microcode - security update
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-4701. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(137374);
      script_version("1.2");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/18");
    
      script_cve_id("CVE-2020-0543", "CVE-2020-0548", "CVE-2020-0549");
      script_xref(name:"DSA", value:"4701");
    
      script_name(english:"Debian DSA-4701-1 : intel-microcode - security update");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis",
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description",
        value:
    "This update ships updated CPU microcode for some types of Intel CPUs
    and provides mitigations for the Special Register Buffer Data Sampling
    (CVE-2020-0543 ), Vector Register Sampling (CVE-2020-0548 ) and L1D
    Eviction Sampling (CVE-2020-0549 ) hardware vulnerabilities.
    
    The microcode update for HEDT and Xeon CPUs with signature 0x50654
    which was reverted in DSA 4565-2 is now included again with a fixed
    release.
    
    The upstream update for Skylake-U/Y (signature 0x406e3) had to be
    excluded from this update due to reported hangs on boot.
    
    For details refer to
    https://www.intel.com/content/www/us/en/security-center/advisory/intel
    -sa-00320.html,
    https://www.intel.com/content/www/us/en/security-center/advisory/intel
    -sa-00329.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-0543"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-0548"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-0549"
      );
      # https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00320.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?c444b53b"
      );
      # https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00329.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?8a852169"
      );
      # https://security-tracker.debian.org/tracker/source-package/intel-microcode
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?019586d4"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/stretch/intel-microcode"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/buster/intel-microcode"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.debian.org/security/2020/dsa-4701"
      );
      script_set_attribute(
        attribute:"solution",
        value:
    "Upgrade the intel-microcode packages.
    
    For the oldstable distribution (stretch), these problems have been
    fixed in version 3.20200609.2~deb9u1.
    
    For the stable distribution (buster), these problems have been fixed
    in version 3.20200609.2~deb10u1."
      );
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:intel-microcode");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:10.0");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:9.0");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2020/01/28");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/06/11");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/06/12");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"10.0", prefix:"intel-microcode", reference:"3.20200609.2~deb10u1")) flag++;
    if (deb_check(release:"9.0", prefix:"intel-microcode", reference:"3.20200609.2~deb9u1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_note(port:0, extra:deb_report_get());
      else security_note(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2020-2431.NASL
    descriptionFrom Red Hat Security Advisory 2020:2431 : The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2431 advisory. - hw: Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543) - hw: Vector Register Data Sampling (CVE-2020-0548) - hw: L1D Cache Eviction Sampling (CVE-2020-0549) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-13
    modified2020-06-12
    plugin id137385
    published2020-06-12
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/137385
    titleOracle Linux 8 : microcode_ctl (ELSA-2020-2431)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-4385-1.NASL
    descriptionIt was discovered that memory contents previously stored in microarchitectural special registers after RDRAND, RDSEED, and SGX EGETKEY read operations on Intel client and Xeon E3 processors may be briefly exposed to processes on the same or different processor cores. A local attacker could use this to expose sensitive information. (CVE-2020-0543) It was discovered that on some Intel processors, partial data values previously read from a vector register on a physical core may be propagated into unused portions of the store buffer. A local attacker could possible use this to expose sensitive information. (CVE-2020-0548) It was discovered that on some Intel processors, data from the most recently evicted modified L1 data cache (L1D) line may be propagated into an unused (invalid) L1D fill buffer. A local attacker could possibly use this to expose sensitive information. (CVE-2020-0549). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-13
    modified2020-06-10
    plugin id137295
    published2020-06-10
    reporterUbuntu Security Notice (C) 2020 Canonical, Inc. / NASL script (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/137295
    titleUbuntu 16.04 LTS / 18.04 LTS / 19.10 / 20.04 : intel-microcode vulnerabilities (USN-4385-1)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2020-2432.NASL
    descriptionThe remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2432 advisory. - hw: Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543) - hw: Vector Register Data Sampling (CVE-2020-0548) - hw: L1D Cache Eviction Sampling (CVE-2020-0549) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-12
    modified2020-06-10
    plugin id137313
    published2020-06-10
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/137313
    titleRHEL 7 : microcode_ctl (RHSA-2020:2432)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2020-2433.NASL
    descriptionThe remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2433 advisory. - hw: Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543) - hw: Vector Register Data Sampling (CVE-2020-0548) - hw: L1D Cache Eviction Sampling (CVE-2020-0549) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-12
    modified2020-06-11
    plugin id137338
    published2020-06-11
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/137338
    titleCentOS 6 : microcode_ctl (CESA-2020:2433)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2020-2433.NASL
    descriptionThe remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2433 advisory. - hw: Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543) - hw: Vector Register Data Sampling (CVE-2020-0548) - hw: L1D Cache Eviction Sampling (CVE-2020-0549) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-12
    modified2020-06-09
    plugin id137273
    published2020-06-09
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/137273
    titleRHEL 6 : microcode_ctl (RHSA-2020:2433)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2020-2431.NASL
    descriptionThe remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2431 advisory. - hw: Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543) - hw: Vector Register Data Sampling (CVE-2020-0548) - hw: L1D Cache Eviction Sampling (CVE-2020-0549) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-12
    modified2020-06-09
    plugin id137276
    published2020-06-09
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/137276
    titleRHEL 8 : microcode_ctl (RHSA-2020:2431)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2020-2432.NASL
    descriptionThe remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2432 advisory. - hw: Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543) - hw: Vector Register Data Sampling (CVE-2020-0548) - hw: L1D Cache Eviction Sampling (CVE-2020-0549) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-12
    modified2020-06-11
    plugin id137337
    published2020-06-11
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/137337
    titleCentOS 7 : microcode_ctl (CESA-2020:2432)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2020-791.NASL
    descriptionThis update for ucode-intel fixes the following issues : Updated Intel CPU Microcode to 20200602 (prerelease) (bsc#1172466) This update contains security mitigations for : - CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This attack is known as Special Register Buffer Data Sampling (SRBDS) or
    last seen2020-06-12
    modified2020-06-11
    plugin id137351
    published2020-06-11
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/137351
    titleopenSUSE Security Update : ucode-intel (openSUSE-2020-791)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-4385-2.NASL
    descriptionUSN-4385-1 provided updated Intel Processor Microcode. Unfortunately, that update prevented certain processors in the Intel Skylake family (06_4EH) from booting successfully. Additonally, on Ubuntu 20.04 LTS, late loading of microcode was enabled, which could lead to system instability. This update reverts the microcode update for the Skylake processor family and disables the late loading option on Ubuntu 20.04 LTS. Please note that the
    last seen2020-06-12
    modified2020-06-11
    plugin id137352
    published2020-06-11
    reporterUbuntu Security Notice (C) 2020 Canonical, Inc. / NASL script (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/137352
    titleUbuntu 16.04 LTS / 18.04 LTS / 19.10 / 20.04 : intel-microcode regression (USN-4385-2)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20200610_MICROCODE_CTL_ON_SL6_X.NASL
    descriptionSecurity Fix(es) : - hw: Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543) - hw: L1D Cache Eviction Sampling (CVE-2020-0549) - hw: Vector Register Data Sampling (CVE-2020-0548)
    last seen2020-06-12
    modified2020-06-11
    plugin id137348
    published2020-06-11
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/137348
    titleScientific Linux Security Update : microcode_ctl on SL6.x i386/x86_64 (20200610)

Redhat

rpms
  • microcode_ctl-4:20191115-4.20200602.2.el8_2
  • microcode_ctl-2:2.1-61.6.el7_8
  • microcode_ctl-debuginfo-2:2.1-61.6.el7_8
  • microcode_ctl-2:1.17-33.26.el6_10
  • microcode_ctl-debuginfo-2:1.17-33.26.el6_10