Arch Linux Security Advisory ASA-202106-34 ========================================== Severity: High Date : 2021-06-15 CVE-ID : CVE-2020-24511 CVE-2020-24512 CVE-2020-24513 CVE-2021-24489 Package : intel-ucode Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-2051 Summary ======= The package intel-ucode before version 20210608-1 is vulnerable to multiple issues including privilege escalation and information disclosure. Resolution ========== Upgrade to 20210608-1. # pacman -Syu "intel-ucode>=20210608-1" The problems have been fixed upstream in version 20210608. Workaround ========== None. Description =========== - CVE-2020-24511 (information disclosure) Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. - CVE-2020-24512 (information disclosure) Observable timing discrepancy in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. - CVE-2020-24513 (information disclosure) Domain-bypass transient execution vulnerability in some Intel Atom(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. - CVE-2021-24489 (privilege escalation) Incomplete cleanup in some Intel(R) VT-d products may allow an authenticated user to potentially enable escalation of privilege via local access. Impact ====== A local attacker could escalate privileges or disclose sensitive information about the processor state using a side-channel attack. References ========== https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00... https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases... https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00... https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00... https://security.archlinux.org/CVE-2020-24511 https://security.archlinux.org/CVE-2020-24512 https://security.archlinux.org/CVE-2020-24513 https://security.archlinux.org/CVE-2021-24489