The version of microcode_ctl installed on the remote host is prior to 2.1-47. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2056 advisory.

  - Insufficient granularity of access control in out-of-band management in some Intel(R) Atom and Intel Xeon     Scalable Processors may allow a privileged user to potentially enable escalation of privilege via adjacent     network access. (CVE-2022-21216)

  - Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R)     Processors when using Intel(R) Software Guard Extensions which may allow a privileged user to potentially     enable escalation of privilege via local access. (CVE-2022-33196)

  - Incorrect calculation in microcode keying mechanism for some 3rd Generation Intel(R) Xeon(R) Scalable     Processors may allow a privileged user to potentially enable information disclosure via local access.
    (CVE-2022-33972)

  - Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard     Extensions may allow a privileged user to potentially enable information disclosure via local access.
    (CVE-2022-38090)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2 : microcode_ctl (ALAS-2023-2056)

medium Nessus Plugin ID 176705

Version 1.1

Version 1.0

Version 1.1 May 11, 2024, 1:11 AM CVE (set "CVE" coverage to "CVE-2022-21216,CVE-2022-33196,CVE-2022-33972,CVE-2022-38090") Plugin metadata Plugin Feed: 202405110111
Version 1.0 Jun 6, 2023, 4:07 AM New Plugin Feed: 202306060407