RedHat: RHSA-2020-2771:01 Moderate: microcode_ctl security,
Summary
Security Fix(es):
* hw: Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543)
* hw: L1D Cache Eviction Sampling (CVE-2020-0549)
* hw: Vector Register Data Sampling (CVE-2020-0548)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s)
listed in the References section.
Bug Fix(es):
* Update Intel CPU microcode to microcode-20200609 release:
- Update of 06-2d-06/0x6d (SNB-E/EN/EP C1/M0) microcode from revision
0x61f
up to 0x621;
- Update of 06-2d-07/0x6d (SNB-E/EN/EP C2/M1) microcode from revision
0x718
up to 0x71a;
- Update of 06-3c-03/0x32 (HSW C0) microcode from revision 0x27 up to
0x28;
- Update of 06-3d-04/0xc0 (BDW-U/Y E0/F0) microcode from revision 0x2e
up to 0x2f;
- Update of 06-45-01/0x72 (HSW-U C0/D0) microcode from revision 0x25
up to 0x26;
- Update of 06-46-01/0x32 (HSW-H C0) microcode from revision 0x1b up to
0x1c;
- Update of 06-47-01/0x22 (BDW-H/Xeon E3 E0/G0) microcode from revision
0x21
up to 0x22;
- Update of 06-4e-03/0xc0 (SKL-U/Y D0) microcode from revision 0xd6
up to 0xdc;
- Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000151
up to 0x1000157;
- Update of 06-55-04/0xb7 (SKX-SP H0/M0/U0, SKX-D M1) microcode
(in intel-06-55-04/intel-ucode/06-55-04) from revision 0x2000065
up to 0x2006906;
- Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x400002c
up to 0x4002f01;
- Update of 06-55-07/0xbf (CLX-SP B1) microcode from revision 0x500002c
up to 0x5002f01;
- Update of 06-5e-03/0x36 (SKL-H/S R0/N0) microcode from revision 0xd6
up to 0xdc;
- Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0x46
up to 0x78;
- Update of 06-8e-09/0x10 (AML-Y22 H0) microcode from revision 0xca
up to 0xd6;
- Update of 06-8e-09/0xc0 (KBL-U/Y H0) microcode from revision 0xca
up to 0xd6;
- Update of 06-8e-0a/0xc0 (CFL-U43e D0) microcode from revision 0xca
up to 0xd6;
- Update of 06-8e-0b/0xd0 (WHL-U W0) microcode from revision 0xca
up to 0xd6;
- Update of 06-8e-0c/0x94 (AML-Y42 V0, CML-Y42 V0, WHL-U V0) microcode
from revision 0xca up to 0xd6;
- Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode from
revision
0xca up to 0xd6;
- Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E3 U0) microcode from revision
0xca
up to 0xd6;
- Update of 06-9e-0b/0x02 (CFL-S B0) microcode from revision 0xca up to
0xd6;
- Update of 06-9e-0c/0x22 (CFL-H/S P0) microcode from revision 0xca
up to 0xd6;
- Update of 06-9e-0d/0x22 (CFL-H R0) microcode from revision 0xca up to
0xd6.
* Do not update 06-4e-03 (SKL-U/Y) and 06-5e-03 (SKL-H/S/Xeon E3 v5) to
revision
0xdc, use 0xd6 by default.
* Enable 06-2d-07 (SNB-E/EN/EP) caveat by default.
* Enable 06-55-04 (SKL-SP/X/W) caveat by default.
* Avoid find being SIGPIPE'd on early "grep -q" exit in the dracut script.
* Re-generate initramfs not only for the currently running kernel,
but for several recently installed kernels as well.
* Change the URL in the intel-microcode2ucode.8 to point to the GitHub
repository since the microcode download section at Intel Download Center
does not exist anymore.
Summary
Solution
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
References
https://access.redhat.com/security/cve/CVE-2020-0543 https://access.redhat.com/security/cve/CVE-2020-0548 https://access.redhat.com/security/cve/CVE-2020-0549 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/solutions/5142691 https://access.redhat.com/solutions/l1d-cache-eviction-and-vector-register-sampling
Package List
Red Hat Enterprise Linux Server AUS (v. 7.4):
Source:
microcode_ctl-2.1-22.32.el7_4.src.rpm
x86_64:
microcode_ctl-2.1-22.32.el7_4.x86_64.rpm
microcode_ctl-debuginfo-2.1-22.32.el7_4.x86_64.rpm
Red Hat Enterprise Linux Server E4S (v. 7.4):
Source:
microcode_ctl-2.1-22.32.el7_4.src.rpm
x86_64:
microcode_ctl-2.1-22.32.el7_4.x86_64.rpm
microcode_ctl-debuginfo-2.1-22.32.el7_4.x86_64.rpm
Red Hat Enterprise Linux Server TUS (v. 7.4):
Source:
microcode_ctl-2.1-22.32.el7_4.src.rpm
x86_64:
microcode_ctl-2.1-22.32.el7_4.x86_64.rpm
microcode_ctl-debuginfo-2.1-22.32.el7_4.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
Topic
An update for microcode_ctl is now available for Red Hat Enterprise Linux7.4 Advances Update Support.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.
Topic
Relevant Releases Architectures
Red Hat Enterprise Linux Server AUS (v. 7.4) - x86_64
Red Hat Enterprise Linux Server E4S (v. 7.4) - x86_64
Red Hat Enterprise Linux Server TUS (v. 7.4) - x86_64
Bugs Fixed
1788786 - CVE-2020-0548 hw: Vector Register Data Sampling
1788788 - CVE-2020-0549 hw: L1D Cache Eviction Sampling
1827165 - CVE-2020-0543 hw: Special Register Buffer Data Sampling (SRBDS)
1849061 - [rhel-7.4.z] Enable SNB-EP caveat by default
