400 lines
20 KiB
JSON
400 lines
20 KiB
JSON
{
|
||
"Definition": [
|
||
{
|
||
"ID": "oval:org.altlinux.errata:def:20238027",
|
||
"Version": "oval:org.altlinux.errata:def:20238027",
|
||
"Class": "patch",
|
||
"Metadata": {
|
||
"Title": "ALT-PU-2023-8027: package `firmware-intel-ucode` update to version 23-alt1.20231114",
|
||
"AffectedList": [
|
||
{
|
||
"Family": "unix",
|
||
"Platforms": [
|
||
"ALT Linux branch p9"
|
||
],
|
||
"Products": [
|
||
"ALT Server",
|
||
"ALT Virtualization Server",
|
||
"ALT Workstation",
|
||
"ALT Workstation K",
|
||
"ALT Education",
|
||
"Simply Linux",
|
||
"Starterkit"
|
||
]
|
||
}
|
||
],
|
||
"References": [
|
||
{
|
||
"RefID": "ALT-PU-2023-8027",
|
||
"RefURL": "https://errata.altlinux.org/ALT-PU-2023-8027",
|
||
"Source": "ALTPU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2020-05481",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2020-05481",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2020-05482",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2020-05482",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-05803",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-05803",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2022-03898",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2022-03898",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2022-05683",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2022-05683",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2022-05690",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2022-05690",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2022-05788",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2022-05788",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2023-04663",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2023-04663",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2023-07325",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2023-07325",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2023-07603",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2023-07603",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2023-07639",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2023-07639",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "CVE-2020-8694",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-8694",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2020-8695",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-8695",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-0127",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-0127",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-0145",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-0145",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-0146",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-0146",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-33120",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-33120",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2022-21151",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2022-21151",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2022-40982",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2022-40982",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2022-41804",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2022-41804",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2023-23583",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-23583",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2023-23908",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-23908",
|
||
"Source": "CVE"
|
||
}
|
||
],
|
||
"Description": "This update upgrades firmware-intel-ucode to version 23-alt1.20231114. \nSecurity Fix(es):\n\n * BDU:2020-05481: Уязвимость драйвера для процессоров Intel(R) ядра операционной системы Linux, связанная с недостатками контроля доступа, позволяющая нарушителю получить доступ к конфиденциальным данным\n\n * BDU:2020-05482: Уязвимость интерфейса RAPL процессоров Intel, позволяющая нарушителю раскрыть защищаемую информацию\n\n * BDU:2021-05803: Уязвимость микропрограммного обеспечения BIOS/UEFI процессоров Intel, позволяющая нарушителю повысить свои привилегии и получить несанкционированный доступ к защищаемой информации\n\n * BDU:2022-03898: Уязвимость микропрограммного обеспечения процессоров Intel, связанная с неверным управлением генерацией кода, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации\n\n * BDU:2022-05683: Уязвимость микрокода процессоров Intel Microcode, связанная с недостаточным использованием потоков, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2022-05690: Уязвимость микрокода процессоров Intel Intel Microcode, позволяющая нарушителю получить доступ к конфиденциальным данным, а также вызвать отказ в обслуживании\n\n * BDU:2022-05788: Уязвимость микрокода процессоров Intel Microcode, связанная с ошибками инициализации памяти, позволяющая нарушителю получить доступ к конфиденциальным данным\n\n * BDU:2023-04663: Уязвимость микропрограммного обеспечения процессоров Intel, связанная с утечкой информации из векторных регистров, позволяющая нарушителю получить доступ к защищаемой информации\n\n * BDU:2023-07325: Уязвимость микропрограммного обеспечения процессоров Intel, позволяющая нарушителю повысить свои привилегии (с третьего до нулевого кольца защиты (CPL0)), получить доступ к конфиденциальной информации или вызвать отказ в обслуживании\n\n * BDU:2023-07603: Уязвимость микрокода процессоров Intel Microcode, связанная с возможностью авария резервного оборудования путём несанкционированного внедрения ошибок, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании\n\n * BDU:2023-07639: Уязвимость микрокода процессоров Intel Microcode, связанная с раскрытием информации, позволяющая нарушителю получить доступ к конфиденциальным данным\n\n * CVE-2020-8694: Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.\n\n * CVE-2020-8695: Observable discrepancy in the RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.\n\n * CVE-2021-0127: Insufficient control flow management in some Intel(R) Processors may allow an authenticated user to potentially enable a denial of service via local access.\n\n * CVE-2021-0145: Improper initialization of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.\n\n * CVE-2021-0146: Hardware allows activation of test or debug logic at runtime for some Intel(R) processors which may allow an unauthenticated user to potentially enable escalation of privilege via physical access.\n\n * CVE-2021-33120: Out of bounds read under complex microarchitectural condition in memory subsystem for some Intel Atom(R) Processors may allow authenticated user to potentially enable information disclosure or cause denial of service via network access.\n\n * CVE-2022-21151: Processor optimization removal or modification of security-critical code for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.\n\n * CVE-2022-40982: Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.\n\n * CVE-2022-41804: Unauthorized error injection in Intel(R) SGX or Intel(R) TDX for some Intel(R) Xeon(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.\n\n * CVE-2023-23583: Sequence of processor instructions leads to unexpected behavior for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege and/or information disclosure and/or denial of service via local access.\n\n * CVE-2023-23908: Improper access control in some 3rd Generation Intel(R) Xeon(R) Scalable processors may allow a privileged user to potentially enable information disclosure via local access.",
|
||
"Advisory": {
|
||
"From": "errata.altlinux.org",
|
||
"Severity": "High",
|
||
"Rights": "Copyright 2024 BaseALT Ltd.",
|
||
"Issued": {
|
||
"Date": "2023-12-25"
|
||
},
|
||
"Updated": {
|
||
"Date": "2023-12-25"
|
||
},
|
||
"BDUs": [
|
||
{
|
||
"ID": "BDU:2020-05481",
|
||
"CVSS": "AV:L/AC:L/Au:S/C:C/I:N/A:N",
|
||
"CVSS3": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||
"CWE": "CWE-284",
|
||
"Href": "https://bdu.fstec.ru/vul/2020-05481",
|
||
"Impact": "Low",
|
||
"Public": "20201110"
|
||
},
|
||
{
|
||
"ID": "BDU:2020-05482",
|
||
"CVSS": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
|
||
"CWE": "CWE-200",
|
||
"Href": "https://bdu.fstec.ru/vul/2020-05482",
|
||
"Impact": "Low",
|
||
"Public": "20200424"
|
||
},
|
||
{
|
||
"ID": "BDU:2021-05803",
|
||
"CVSS": "AV:L/AC:H/Au:N/C:C/I:C/A:C",
|
||
"CVSS3": "AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
||
"CWE": "CWE-200",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-05803",
|
||
"Impact": "High",
|
||
"Public": "20210911"
|
||
},
|
||
{
|
||
"ID": "BDU:2022-03898",
|
||
"CVSS": "AV:L/AC:H/Au:S/C:C/I:N/A:N",
|
||
"CVSS3": "AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N",
|
||
"CWE": "CWE-94, CWE-200",
|
||
"Href": "https://bdu.fstec.ru/vul/2022-03898",
|
||
"Impact": "Low",
|
||
"Public": "20211115"
|
||
},
|
||
{
|
||
"ID": "BDU:2022-05683",
|
||
"CVSS": "AV:L/AC:L/Au:S/C:N/I:N/A:C",
|
||
"CVSS3": "AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
|
||
"CWE": "CWE-691",
|
||
"Href": "https://bdu.fstec.ru/vul/2022-05683",
|
||
"Impact": "Low",
|
||
"Public": "20200122"
|
||
},
|
||
{
|
||
"ID": "BDU:2022-05690",
|
||
"CVSS": "AV:N/AC:L/Au:S/C:P/I:N/A:P",
|
||
"CVSS3": "AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
|
||
"CWE": "CWE-125",
|
||
"Href": "https://bdu.fstec.ru/vul/2022-05690",
|
||
"Impact": "Low",
|
||
"Public": "20220209"
|
||
},
|
||
{
|
||
"ID": "BDU:2022-05788",
|
||
"CVSS": "AV:L/AC:L/Au:S/C:C/I:N/A:N",
|
||
"CVSS3": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||
"CWE": "CWE-665",
|
||
"Href": "https://bdu.fstec.ru/vul/2022-05788",
|
||
"Impact": "Low",
|
||
"Public": "20201022"
|
||
},
|
||
{
|
||
"ID": "BDU:2023-04663",
|
||
"CVSS": "AV:L/AC:L/Au:S/C:C/I:N/A:N",
|
||
"CVSS3": "AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
|
||
"CWE": "CWE-203, CWE-1342",
|
||
"Href": "https://bdu.fstec.ru/vul/2023-04663",
|
||
"Impact": "Low",
|
||
"Public": "20230808"
|
||
},
|
||
{
|
||
"ID": "BDU:2023-07325",
|
||
"CVSS": "AV:L/AC:L/Au:S/C:C/I:C/A:C",
|
||
"CVSS3": "AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
||
"CWE": "CWE-264, CWE-1281",
|
||
"Href": "https://bdu.fstec.ru/vul/2023-07325",
|
||
"Impact": "High",
|
||
"Public": "20231024"
|
||
},
|
||
{
|
||
"ID": "BDU:2023-07603",
|
||
"CVSS": "AV:L/AC:L/Au:M/C:C/I:C/A:C",
|
||
"CVSS3": "AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-1334",
|
||
"Href": "https://bdu.fstec.ru/vul/2023-07603",
|
||
"Impact": "Low",
|
||
"Public": "20230808"
|
||
},
|
||
{
|
||
"ID": "BDU:2023-07639",
|
||
"CVSS": "AV:L/AC:L/Au:M/C:C/I:N/A:N",
|
||
"CVSS3": "AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
|
||
"CWE": "CWE-200",
|
||
"Href": "https://bdu.fstec.ru/vul/2023-07639",
|
||
"Impact": "Low",
|
||
"Public": "20230808"
|
||
}
|
||
],
|
||
"CVEs": [
|
||
{
|
||
"ID": "CVE-2020-8694",
|
||
"CVSS": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
|
||
"CVSS3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||
"CWE": "NVD-CWE-Other",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-8694",
|
||
"Impact": "Low",
|
||
"Public": "20201112"
|
||
},
|
||
{
|
||
"ID": "CVE-2020-8695",
|
||
"CVSS": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
|
||
"CVSS3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||
"CWE": "CWE-203",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-8695",
|
||
"Impact": "Low",
|
||
"Public": "20201112"
|
||
},
|
||
{
|
||
"ID": "CVE-2021-0127",
|
||
"CVSS": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
|
||
"CWE": "NVD-CWE-Other",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-0127",
|
||
"Impact": "Low",
|
||
"Public": "20220209"
|
||
},
|
||
{
|
||
"ID": "CVE-2021-0145",
|
||
"CVSS": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
|
||
"CVSS3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||
"CWE": "CWE-665",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-0145",
|
||
"Impact": "Low",
|
||
"Public": "20220209"
|
||
},
|
||
{
|
||
"ID": "CVE-2021-0146",
|
||
"CVSS": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "NVD-CWE-Other",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-0146",
|
||
"Impact": "Low",
|
||
"Public": "20211117"
|
||
},
|
||
{
|
||
"ID": "CVE-2021-33120",
|
||
"CVSS": "AV:N/AC:L/Au:S/C:P/I:N/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
|
||
"CWE": "CWE-125",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-33120",
|
||
"Impact": "Low",
|
||
"Public": "20220209"
|
||
},
|
||
{
|
||
"ID": "CVE-2022-21151",
|
||
"CVSS": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
|
||
"CVSS3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||
"CWE": "NVD-CWE-Other",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2022-21151",
|
||
"Impact": "Low",
|
||
"Public": "20220512"
|
||
},
|
||
{
|
||
"ID": "CVE-2022-40982",
|
||
"CVSS3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
|
||
"CWE": "CWE-203",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2022-40982",
|
||
"Impact": "Low",
|
||
"Public": "20230811"
|
||
},
|
||
{
|
||
"ID": "CVE-2022-41804",
|
||
"CVSS3": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "NVD-CWE-Other",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2022-41804",
|
||
"Impact": "Low",
|
||
"Public": "20230811"
|
||
},
|
||
{
|
||
"ID": "CVE-2023-23583",
|
||
"CVSS3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "NVD-CWE-noinfo",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-23583",
|
||
"Impact": "High",
|
||
"Public": "20231114"
|
||
},
|
||
{
|
||
"ID": "CVE-2023-23908",
|
||
"CVSS3": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
|
||
"CWE": "NVD-CWE-noinfo",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-23908",
|
||
"Impact": "Low",
|
||
"Public": "20230811"
|
||
}
|
||
],
|
||
"AffectedCPEs": {
|
||
"CPEs": [
|
||
"cpe:/o:alt:kworkstation:9",
|
||
"cpe:/o:alt:workstation:9",
|
||
"cpe:/o:alt:server:9",
|
||
"cpe:/o:alt:server-v:9",
|
||
"cpe:/o:alt:education:9",
|
||
"cpe:/o:alt:slinux:9",
|
||
"cpe:/o:alt:starterkit:p9",
|
||
"cpe:/o:alt:kworkstation:9.1",
|
||
"cpe:/o:alt:workstation:9.1",
|
||
"cpe:/o:alt:server:9.1",
|
||
"cpe:/o:alt:server-v:9.1",
|
||
"cpe:/o:alt:education:9.1",
|
||
"cpe:/o:alt:slinux:9.1",
|
||
"cpe:/o:alt:starterkit:9.1",
|
||
"cpe:/o:alt:kworkstation:9.2",
|
||
"cpe:/o:alt:workstation:9.2",
|
||
"cpe:/o:alt:server:9.2",
|
||
"cpe:/o:alt:server-v:9.2",
|
||
"cpe:/o:alt:education:9.2",
|
||
"cpe:/o:alt:slinux:9.2",
|
||
"cpe:/o:alt:starterkit:9.2"
|
||
]
|
||
}
|
||
}
|
||
},
|
||
"Criteria": {
|
||
"Operator": "AND",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:1001",
|
||
"Comment": "ALT Linux must be installed"
|
||
}
|
||
],
|
||
"Criterias": [
|
||
{
|
||
"Operator": "OR",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20238027001",
|
||
"Comment": "firmware-intel-ucode is earlier than 2:23-alt1.20231114"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
}
|
||
]
|
||
} |