Patch Tuesday: Intel and AMD Disclose 130+ Vulnerabilities

Rohan Timalsina

December 14, 2023 - TuxCare expert team

In the cybersecurity world, the second Tuesday of every month is a significant date marked by the release of security updates known as Patch Tuesday. This monthly event sees major technology players like Intel and AMD patching vulnerabilities in their products to protect users from potential threats.

Intel’s Patch Tuesday Insights

Intel recently published 31 advisories covering a staggering 105 vulnerabilities. Among these, the discovery of Reptar (CVE-2023-23583) stands out. This internal revelation by Intel and independent confirmation by Google researchers identified a critical CPU flaw. Dubbed Reptar, it could potentially crash host machines and other guest machines in a multi-tenant virtualized environment, leading to information disclosure or privilege escalation.

Another focal point in Intel’s security advisories is the critical vulnerability (CVE-2023-31273) found in the Data Center Manager (DCM) software. This vulnerability, with a CVSS score of 10, opens the door for unauthenticated attackers to escalate privileges through network access. The remaining nine advisories address high-severity vulnerabilities across various Intel products, encompassing oneAPI, Server Board and Server System BIOS firmware, QuickAssist Technology (QAT), NUC software, One Boot Flash Update (OFU) software, Connectivity Performance Suite software, In-Band Manageability software, and Unison software.

AMD’s Security Advisories

On the Patch Tuesday stage, AMD also took the spotlight, releasing five security advisories that collectively addressed 27 vulnerabilities. One of the notable vulnerabilities, CacheWarp (CVE-2023-20592), pertains to a new AMD CPU vulnerability posing a risk to virtual machines (VMs). This flaw could potentially allow attackers to hijack control flow, breach encrypted VMs, and escalate privileges. CacheWarp specifically affects AMD Secure Encrypted Virtualization (SEV).

AMD’s advisories further highlighted vulnerabilities in the Secure Processor (ASP), System Management Unit (SMU), and other components. Among these, four high-severity issues could result in arbitrary code execution or privilege escalation. Additionally, a high-severity flaw in SMM Supervisor was addressed, mitigating potential exploitation for arbitrary code execution.

The server domain also faced scrutiny, with ten vulnerabilities, including one leading to code execution, being addressed. AMD didn’t neglect graphics drivers, fixing four medium-severity flaws capable of allowing arbitrary code execution or causing a Denial of Service (DoS) condition.

Conclusion

Patch Tuesday remains a crucial event for cybersecurity, unveiling the intricate web of vulnerabilities within the products of industry giants like Intel and AMD. The recent releases by both companies serve as a stark reminder of the continuous efforts required to fortify digital landscapes against potential threats. As users navigate the ever-evolving cyber terrain, staying informed about these vulnerabilities and promptly applying patches becomes paramount for a secure and resilient digital experience.

The sources for this article include a story from SecurityWeek.

Summary