Improper or unexpected behavior of the INVD instruction in some AMD CPUs may allow an attacker with a malicious hypervisor to affect cache line write-back behavior of the CPU leading to a potential loss of guest virtual machine (VM) memory integrity.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-3178 advisory.

    [20240415-999.32.git5da74b16.el8]
    - Rebase to latest upstream [Orabug: 36482906]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3178 advisory.

    The linux-firmware packages contain all of the firmware files that are required by various devices to     operate.

    Security Fix(es):

    * hw: intel: Protection mechanism failure for some Intel(R) PROSet/Wireless WiFi (CVE-2022-46329)

    * hw: amd: INVD instruction may lead to a loss of SEV-ES guest machine memory integrity problem     (CVE-2023-20592)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.10 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:3178 advisory.

  - Protection mechanism failure for some Intel(R) PROSet/Wireless WiFi software may allow a privileged user     to potentially enable escalation of privilege via local access. (CVE-2022-46329)

  - Improper or unexpected behavior of the INVD instruction in some AMD CPUs may allow an attacker with a     malicious hypervisor to affect cache line write-back behavior of the CPU leading to a potential loss of     guest virtual machine (VM) memory integrity. (CVE-2023-20592)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0753 advisory.

  - hw: amd: INVD instruction may lead to a loss of SEV-ES guest machine memory integrity problem     (CVE-2023-20592)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1112 advisory.

  - hw: intel: Protection mechanism failure for some Intel(R) PROSet/Wireless WiFi (CVE-2022-46329)

  - hw: amd: INVD instruction may lead to a loss of SEV-ES guest machine memory integrity problem     (CVE-2023-20592)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0979 advisory.

  - hw: amd: INVD instruction may lead to a loss of SEV-ES guest machine memory integrity problem     (CVE-2023-20592)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0978 advisory.

  - hw: amd: INVD instruction may lead to a loss of SEV-ES guest machine memory integrity problem     (CVE-2023-20592)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0753 advisory.

  - Improper or unexpected behavior of the INVD instruction in some AMD CPUs may allow an attacker with a     malicious hypervisor to affect cache line write-back behavior of the CPU leading to a potential loss of     guest virtual machine (VM) memory integrity. (CVE-2023-20592)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4654-1 advisory.

  - Failure to validate the value in APCB may allow a privileged attacker to tamper with the APCB token to     force an out-of-bounds memory read potentially resulting in a denial of service. (CVE-2021-26345)

  - Improper clearing of sensitive data in the ASP Bootloader may expose secret keys to a privileged attacker     accessing ASP SRAM, potentially leading to a loss of confidentiality. (CVE-2021-46766)

  - Insufficient DRAM address validation in System Management Unit (SMU) may allow an attacker to read/write     from/to an invalid DRAM address, potentially resulting in denial-of-service. (CVE-2021-46774,     CVE-2023-20533)

  - Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM     potentially leading to arbitrary code execution. (CVE-2022-23820)

  - SMM configuration may not be immutable, as intended, when SNP is enabled resulting in a potential limited     loss of guest memory integrity. (CVE-2022-23830)

  - A Use-After-Free vulnerability in the management of an SNP guest context page may allow a malicious     hypervisor to masquerade as the guest's migration agent resulting in a potential loss of guest integrity.
    (CVE-2023-20519)

  - TOCTOU in the ASP Bootloader may allow an attacker with physical access to tamper with SPI ROM records     after memory content verification, potentially leading to loss of confidentiality or a denial of service.
    (CVE-2023-20521)

  - Insufficient input validation in the ASP Bootloader may enable a privileged attacker with physical access     to expose the contents of ASP memory potentially leading to a loss of confidentiality. (CVE-2023-20526)

  - Improper address validation in ASP with SNP enabled may potentially allow an attacker to compromise guest     memory integrity. (CVE-2023-20566)

  - Improper or unexpected behavior of the INVD instruction in some AMD CPUs may allow an attacker with a     malicious hypervisor to affect cache line write-back behavior of the CPU leading to a potential loss of     guest virtual machine (VM) memory integrity. (CVE-2023-20592)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4665-1 advisory.

  - Failure to validate the value in APCB may allow a privileged attacker to tamper with the APCB token to     force an out-of-bounds memory read potentially resulting in a denial of service. (CVE-2021-26345)

  - Improper clearing of sensitive data in the ASP Bootloader may expose secret keys to a privileged attacker     accessing ASP SRAM, potentially leading to a loss of confidentiality. (CVE-2021-46766)

  - Insufficient DRAM address validation in System Management Unit (SMU) may allow an attacker to read/write     from/to an invalid DRAM address, potentially resulting in denial-of-service. (CVE-2021-46774,     CVE-2023-20533)

  - Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM     potentially leading to arbitrary code execution. (CVE-2022-23820)

  - SMM configuration may not be immutable, as intended, when SNP is enabled resulting in a potential limited     loss of guest memory integrity. (CVE-2022-23830)

  - A Use-After-Free vulnerability in the management of an SNP guest context page may allow a malicious     hypervisor to masquerade as the guest's migration agent resulting in a potential loss of guest integrity.
    (CVE-2023-20519)

  - TOCTOU in the ASP Bootloader may allow an attacker with physical access to tamper with SPI ROM records     after memory content verification, potentially leading to loss of confidentiality or a denial of service.
    (CVE-2023-20521)

  - Insufficient input validation in the ASP Bootloader may enable a privileged attacker with physical access     to expose the contents of ASP memory potentially leading to a loss of confidentiality. (CVE-2023-20526)

  - Improper address validation in ASP with SNP enabled may potentially allow an attacker to compromise guest     memory integrity. (CVE-2023-20566)

  - Improper or unexpected behavior of the INVD instruction in some AMD CPUs may allow an attacker with a     malicious hypervisor to affect cache line write-back behavior of the CPU leading to a potential loss of     guest virtual machine (VM) memory integrity. (CVE-2023-20592)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
198040	Oracle Linux 8 : linux-firmware (ELSA-2024-3178)	Nessus	Oracle Linux Local Security Checks	medium
197772	RHEL 8 : linux-firmware (RHSA-2024:3178)	Nessus	Red Hat Local Security Checks	medium
197657	CentOS 8 : linux-firmware (CESA-2024:3178)	Nessus	CentOS Local Security Checks	medium
194385	RHEL 7 : linux-firmware (RHSA-2024:0753)	Nessus	Red Hat Local Security Checks	medium
191580	RHEL 8 : linux-firmware (RHSA-2024:1112)	Nessus	Red Hat Local Security Checks	medium
191026	RHEL 7 : linux-firmware (RHSA-2024:0979)	Nessus	Red Hat Local Security Checks	medium
191018	RHEL 7 : linux-firmware (RHSA-2024:0978)	Nessus	Red Hat Local Security Checks	medium
190366	CentOS 7 : linux-firmware (RHSA-2024:0753)	Nessus	CentOS Local Security Checks	medium
186648	SUSE SLES15 Security Update : kernel-firmware (SUSE-SU-2023:4654-1)	Nessus	SuSE Local Security Checks	critical
186646	SUSE SLES15 Security Update : kernel-firmware (SUSE-SU-2023:4665-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2023-20592

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

critical

critical