Intel November 2023 Microcode Update

Overview

Red Hat is aware of several CPU hardware flaws that affect Intel CPU hardware microarchitecture and on-board components.

Red Hat provides updated microcode, developed by our microprocessor partners, as a customer convenience. Please contact your hardware vendor to determine whether more recent BIOS/firmware updates are recommended, as additional improvements may be available.

Background

Security Issues

CVE-2023-23583: execution of MOVSB instructions with redundant REX prefix leads to unintended system behavior

A security vulnerability was found in some Intel processors. Execution of REP MOVSB instructions with a redundant REX prefix may result in execution continuing at an incorrect EIP address after a micro-architectural event occurs, potentially allowing privilege escalation, information disclosure and/or a denial of service via local access.

This issue requires a microcode update.

This issue has been assigned CVE-2023-23583 and is rated Important.

See also:

• Tech Paper: Redundant Prefix Issue
• INTEL-SA-00950
• Blog: Chips & Salsa Episode 60: Unexpected Redundant Prefix Behavior

Update Availability

The updates are provided based on the supported status of the affected CPU models for each specific Red Hat product version.

Affected Configurations

Listed below are the CPU families affected by these flaws broken down by the flaw type. You must determine your CPU’s family to see if you are affected.

Find Your CPU Family Model

Find the CPU model provided by your system. This is available in the /proc/cpuinfo file.

$ grep -E '^(cpu family|model|stepping|microcode)' /proc/cpuinfo | sort -u
cpu family  : 6
microcode   : 0x84
model       : 94
model name  : Intel(R) Core(TM) i7-6820HQ CPU @ 2.70GHz
stepping    : 3

(Note: on RHEL 6, microcode revision is in decimal; on RHEL 7 onwards, it is in hexadecimal with the respective "0x" prefix.)

Intel Microcode Updates That Mitigate The Issues

See also:

• Affected Processors: Transient Execution Attacks & Related Security Issues by CPU

Resolution

Red Hat customers running affected versions of the Red Hat products are strongly recommended to update them as soon as errata are available. Customers are urged to apply the appropriate updates immediately to mitigate this flaw correctly.

Acknowledgements

Red Hat thanks Intel for fixing these issues and making Red Hat aware.

Frequently Asked Questions

Q: Do I need to reboot for the changes to take effect?
A: No. Updating the microcode package to a version equal or later to the one identified in the table above is sufficient for these issues to be fixed.

Q: What if my CPU is not listed in the table?
A: Red Hat will continue to update these microcode packages as necessary. Please contact your hardware vendor to determine whether more recent BIOS/firmware updates are recommended because additional improvements may be available.

Additional Information

Red Hat can not guarantee the correctness of the above information as the microcode update is provided by upstream vendors.

Related Knowledge Base articles:

• Is CPU microcode available to address CVE-2017-5715 via the microcode_ctl package?
• Is CPU microcode available to address CVE-2018-3639 via the microcode_ctl package?
• Is CPU microcode available to address CVE-2018-3620 and CVE-2018-3646 via the microcode_ctl package?
• Is CPU microcode available to address MDS (ZombieLoad) CVE-2018-12130, CVE-2018-12126, CVE-2018-12127, and CVE-2019-11091 via the microcode_ctl package?
• Intel November 2019 Microcode Update
• Intel June 2020 Microcode Update
• Intel November 2020 Microcode Update
• Intel June 2021 Microcode Update
• Intel Febraury 2022 Microcode Update