Scientific Linux Security Update : microcode_ctl on SL6.x, SL7.x i386/x86_64 (Spectre)

Medium Nessus Plugin ID 106227

Synopsis

The remote Scientific Linux host is missing one or more security updates.

Description

This update supersedes the previous microcode update provided with the CVE-2017-5715 (Spectre) CPU branch injection vulnerability mitigation.
Further testing has uncovered problems with the microcode provided along with the Spectre mitigation that could lead to system instabilities.

As a result, this microcode update reverts to the last known good microcode version dated before 03 January 2018.

You should contact your hardware provider for the latest microcode updates.

IMPORTANT: If you are using Intel Skylake-, Broadwell-, and Haswell-based platforms, obtain and install updated microcode from your hardware vendor immediately. The 'Spectre' mitigation requires both an updated kernel and updated microcode from your hardware vendor.

Solution

Update the affected microcode_ctl and / or microcode_ctl-debuginfo packages.

See Also

http://www.nessus.org/u?bca6d976

Plugin Details

Severity: Medium

ID: 106227

File Name: sl_20180116_microcode_ctl_on_SL6_x.nasl

Version: $Revision: 3.4 $

Type: local

Agent: unix

Published: 2018/01/22

Modified: 2018/01/29

Dependencies: 12634

Risk Information

Risk Factor: Medium

CVSSv2

Base Score: 4.7

Vector: CVSS2#AV:L/AC:M/Au:N/C:C/I:N/A:N

CVSSv3

Base Score: 5.6

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Vulnerability Information

CPE: x-cpe:/o:fermilab:scientific_linux

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/RedHat/release, Host/RedHat/rpm-list

Patch Publication Date: 2018/01/16

Reference Information

CVE: CVE-2017-5715

IAVA: 2018-A-0020