Protection mechanism failure of bus lock regulator for some Intel(R) Processors may allow an unauthenticated user to potentially enable denial of service via network access.

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3808 advisory.

  - Protection mechanism failure in some 3rd and 4th Generation Intel(R) Xeon(R) Processors when using     Intel(R) SGX or Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege via     local access. (CVE-2023-22655)

  - Information exposure through microarchitectural state after transient execution from some register files     for some Intel(R) Atom(R) Processors may allow an authenticated user to potentially enable information     disclosure via local access. (CVE-2023-28746)

  - Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow     an authorized user to potentially enable information disclosure via local access. (CVE-2023-38575)

  - Protection mechanism failure of bus lock regulator for some Intel(R) Processors may allow an     unauthenticated user to potentially enable denial of service via network access. (CVE-2023-39368)

  - Incorrect calculation in microcode keying mechanism for some Intel(R) Xeon(R) D Processors with Intel(R)     SGX may allow a privileged user to potentially enable information disclosure via local access.
    (CVE-2023-43490)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1139-1 advisory.

  - Protection mechanism failure in some 3rd and 4th Generation Intel(R) Xeon(R) Processors when using     Intel(R) SGX or Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege via     local access. (CVE-2023-22655)

  - Information exposure through microarchitectural state after transient execution from some register files     for some Intel(R) Atom(R) Processors may allow an authenticated user to potentially enable information     disclosure via local access. (CVE-2023-28746)

  - Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow     an authorized user to potentially enable information disclosure via local access. (CVE-2023-38575)

  - Protection mechanism failure of bus lock regulator for some Intel(R) Processors may allow an     unauthenticated user to potentially enable denial of service via network access. (CVE-2023-39368)

  - Incorrect calculation in microcode keying mechanism for some Intel(R) Xeon(R) D Processors with Intel(R)     SGX may allow a privileged user to potentially enable information disclosure via local access.
    (CVE-2023-43490)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0917-1 advisory.

  - Protection mechanism failure in some 3rd and 4th Generation Intel(R) Xeon(R) Processors when using     Intel(R) SGX or Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege via     local access. (CVE-2023-22655)

  - Information exposure through microarchitectural state after transient execution from some register files     for some Intel(R) Atom(R) Processors may allow an authenticated user to potentially enable information     disclosure via local access. (CVE-2023-28746)

  - Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow     an authorized user to potentially enable information disclosure via local access. (CVE-2023-38575)

  - Protection mechanism failure of bus lock regulator for some Intel(R) Processors may allow an     unauthenticated user to potentially enable denial of service via network access. (CVE-2023-39368)

  - Incorrect calculation in microcode keying mechanism for some Intel(R) Xeon(R) D Processors with Intel(R)     SGX may allow a privileged user to potentially enable information disclosure via local access.
    (CVE-2023-43490)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-559 advisory.

  - Non-transparent sharing of return predictor targets between contexts in some Intel Processors may allow     an authorized user to potentially enable information disclosure via local access. (CVE-2023-38575)     (CVE-2023-38575, CVE-2023-39368)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the b6dd9d93-e09b-11ee-92fc-1c697a616631 advisory.

  - Intel reports: 2024.1 IPU - Intel Processor Bus Lock Advisory A potential security vulnerability in the     bus lock regulator           mechanism for some Intel Processors may allow denial of service. Intel     is releasing firmware updates to mitigate this potential           vulnerability. 2024.1 IPU - Intel     Processor Return Predictions Advisory A potential security vulnerability in some Intel Processors may     allow information disclosure. 2024.1 IPU - Intel Atom Processor Advisory A potential security     vulnerability in some Intel Atom Processors           may allow information disclosure. 2024.1 IPU - Intel     Xeon Processor Advisory A potential security vulnerability in some 3rd and 4th Generation           Intel     Xeon Processors when using Intel Software Guard Extensions (SGX)           or Intel Trust Domain     Extensions (TDX) may allow escalation of           privilege. 2024.1 IPU OOB - Intel Xeon D Processor     Advisory A potential security vulnerability in some Intel Xeon D Processors           with Intel Software     Guard Extensions (SGX) may allow information           disclosure. (CVE-2023-22655, CVE-2023-43490)

  - This CVE was assigned by Intel. Please see CVE-2023-28746 on CVE.org for more information.
    (CVE-2023-28746)

  - Non-transparent sharing of return predictor targets between contexts in some Intel Processors may allow     an authorized user to potentially enable information disclosure via local access. (CVE-2023-38575)     (CVE-2023-38575, CVE-2023-39368)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of microcode_ctl installed on the remote host is prior to 2.1-47. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2491 advisory.

  - Non-transparent sharing of return predictor targets between contexts in some Intel Processors may     allow an authorized user to potentially enable information disclosure via local access. (CVE-2023-38575)     (CVE-2023-38575, CVE-2023-39368)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
195662	RHEL 6 : kernel (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
194982	Debian dla-3808 : intel-microcode - security update	Nessus	Debian Local Security Checks	medium
193040	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : ucode-intel (SUSE-SU-2024:1139-1)	Nessus	SuSE Local Security Checks	medium
192491	SUSE SLES12 Security Update : ucode-intel (SUSE-SU-2024:0917-1)	Nessus	SuSE Local Security Checks	medium
192032	Amazon Linux 2023 : microcode_ctl (ALAS2023-2024-559)	Nessus	Amazon Linux Local Security Checks	medium
192024	FreeBSD : Intel CPUs -- multiple vulnerabilities (b6dd9d93-e09b-11ee-92fc-1c697a616631)	Nessus	FreeBSD Local Security Checks	medium
191959	Amazon Linux 2 : microcode_ctl (ALAS-2024-2491)	Nessus	Amazon Linux Local Security Checks	medium

Detections

Analytics

CVE-2023-39368

medium

Tenable Plugins

critical

medium

medium

medium

medium

medium

medium