Intel November 2020 Microcode Update

Overview

Red Hat is aware of several CPU hardware flaws that affect Intel CPU hardware microarchitecture and on-board components.

Red Hat provides updated microcode, developed by our microprocessor partners, as a customer convenience.  Please contact your hardware vendor to determine whether more recent BIOS/firmware updates are recommended, as additional improvements may be available.

Background

CVE-2020-8695: Information disclosure issue in Intel SGX via RAPL interface

A vulnerability was found in Intel's implementation of RAPL (Running Average Power Limit). An attacker with a local account could query the power management functionality to intelligently infer SGX enclave computation values by measuring power usage in the RAPL subsystem.

This creates a 'power analysis' side channel, where the attacker can use the RAPL values exported to the operating system as a method to analyse the side channel without physical access.

This issue requires a microcode update. There is a related kernel update which restricts permissions on the values exported to the operating system. The microcode fix would prevent access to infer SGX enclave power values, whereas the permissions fix would prevent other non SGX values from being inferred via the side channel.

This issue has been assigned CVE-2020-8695 and is rated Moderate.

See also:

• Intel-SA-00389
• IPAS: November 2020 Intel Platform Update
• Research Whitepaper ("PLATYPUS: Software-based Power Side-Channel Attacks on x86")

CVE-2020-8696: Vector Register Leakage-Active

A flaw was found in the Intel Advanced Vector Extensions (AVX) implementation, where a local authenticated attacker with the ability to execute AVX instructions can gather the AVX register state from previous AVX executions. This vulnerability allows information disclosure of the AVX register state.

This issue requires a microcode update.

This issue has been assigned CVE-2020-8696 and is rated Low.

See also:

• Intel-SA-00381

CVE-2020-8698: Fast forward store predictor

A flaw was found in the CPU microarchitecture where a local attacker is able to abuse a timing issue which may allow them to infer internal architectural state from previous executions on the CPU.

This issue requires a microcode update.

This issue has been assigned CVE-2020-8698 and is rated Moderate.

See also:

• Intel-SA-00381

Diagnostic Tools

At this time there is no method of knowing if an attack has taken place.

Affected Products

(*) Not affected by CVE-2020-8695.

Affected Configurations

Listed below are the CPU families affected by these flaws broken down by the flaw type. You must determine your CPU’s family to see if you are affected.  

Find your CPU family model

Find the CPU model provided by your system.  This is available in the /proc/cpuinfo file.

$ grep -E '^(cpu family|model|stepping|microcode)' /proc/cpuinfo | sort -u
cpu family  : 6
microcode   : 0x84
model       : 94
model name  : Intel(R) Core(TM) i7-6820HQ CPU @ 2.70GHz
stepping    : 3

(Note: on RHEL 6, microcode revision is in decimal; on RHEL 7 onwards, it is in hexadecimal with the respective prefix.)

Intel Microcode Updates that mitigate the issues

(*) The update is disabled by default due to possible hangs. See /usr/share/doc/microcode_ctl/caveats/06-4e-03_readme for details.

(**) The update is disabled by default due to possible hangs. See /usr/share/doc/microcode_ctl/caveats/06-5e-03_readme for details.

(***) The update will be available at a later date.

Resolution

Red Hat customers running affected versions of the Red Hat products are strongly recommended to update them as soon as errata are available. Customers are urged to apply the appropriate updates immediately and reboot to mitigate this flaw correctly.

Acknowledgements

Red Hat thanks Intel for fixing these issues and making Red Hat aware.

Frequently Asked Questions

Q: Do I need to reboot for the changes to take effect?
A: There are two sections to this update. The microcode update does not require a system reboot to take effect. The kernel update includes a modification which changes the permissions on the exported RAPL device that would allow an attacker to abuse this flaw. The kernel will need to be updated and system rebooted for the changes in permissions to take effect.

Q: What if my CPU is not listed in the table?
A: Red Hat will continue to update these microcode packages as necessary. Please contact your hardware vendor to determine whether more recent BIOS/firmware updates are recommended because additional improvements may be available.

Additional Information

Red Hat can not guarantee the correctness of the above information as the microcode update is provided by upstream vendors.

Related Knowledge Base articles:

• Is CPU microcode available to address CVE-2017-5715 via the microcode_ctl package?
• Is CPU microcode available to address CVE-2018-3639 via the microcode_ctl package?
• Is CPU microcode available to address CVE-2018-3620 and CVE-2018-3646 via the microcode_ctl package?
• Is CPU microcode available to address MDS (ZombieLoad) CVE-2018-12130, CVE-2018-12126, CVE-2018-12127, and CVE-2019-11091 via the microcode_ctl package?
• Intel November 2019 Microcode Update
• Intel June 2020 Microcode Update