The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3808 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3808-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Tobias Frost     May 04, 2024                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : intel-microcode     Version        : 3.20240312.1~deb10u1     CVE ID         : CVE-2023-22655 CVE-2023-28746 CVE-2023-38575 CVE-2023-39368                      CVE-2023-43490     Debian Bug     : 1066108

    Intel has released microcode updates, addressing serveral vulnerabilties.

    CVE-2023-22655

        Protection mechanism failure in some 3rd and 4th Generation Intel(R)         Xeon(R) Processors when using Intel(R) SGX or Intel(R) TDX may allow         a privileged user to potentially enable escalation of privilege via         local access.

    CVE-2023-28746

        Information exposure through microarchitectural state after         transient execution from some register files for some Intel(R)         Atom(R) Processors may allow an authenticated user to potentially         enable information disclosure via local access.

    CVE-2023-38575

        Non-transparent sharing of return predictor targets between contexts         in some Intel(R) Processors may allow an authorized user to         potentially enable information disclosure via local access.

    CVE-2023-39368

        Protection mechanism failure of bus lock regulator for some Intel(R)         Processors may allow an unauthenticated user to potentially enable         denial of service via network access.

    CVE-2023-43490

        Incorrect calculation in microcode keying mechanism for some         Intel(R) Xeon(R) D Processors with Intel(R) SGX may allow a         privileged user to potentially enable information disclosure via         local access.

    For Debian 10 buster, these problems have been fixed in version     3.20240312.1~deb10u1.

    We recommend that you upgrade your intel-microcode packages.

    For the detailed security status of intel-microcode please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/intel-microcode

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-3808 : intel-microcode - security update

medium Nessus Plugin ID 194982

Version 1.1

Version 1.0

Version 1.1 Jan 22, 2025, 3:03 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Plugin metadata Plugin Feed: 202501221503
Version 1.0 May 5, 2024, 2:16 AM New Plugin Feed: 202405050216