More Information:

Security Advisories that affect BIOS:

• INTEL-SA-01038 – 2024.2 IPU - Intel® Core™ Ultra Processor Stream Cache Advisory
  • Summary: A potential security vulnerability in the Intel® Core™ Ultra Processor stream cache mechanism may allow escalation of privilege. Intel is releasing microcode updates to mitigate this potential vulnerability.
  • Severity: High
• INTEL-SA-01046 – 2024.2 IPU - Intel® Processor Stream Cache Advisory
  • Summary: A potential security vulnerability in some Intel® Processor stream cache mechanisms may allow escalation of privilege. Intel is releasing microcode updates to mitigate this potential vulnerability.
  • Severity: High
• INTEL-SA-00999 – 2024.3 IPU - Intel® Chipset Firmware Advisory
  • Summary: Potential security vulnerabilities in Intel® Converged Security and Manageability Engine (CSME), Intel® Active Management Technology (AMT), Intel® Standard Manageability, Intel® PROSet/Wireless and Intel® Killer™ Wi-Fi software may allow escalation of privilege, denial of service, or information disclosure. Intel is releasing firmware updates to mitigate these potential vulnerabilities.
  • Severity: Medium
• INTEL-SA-01083 – 2024.3 IPU - SMI Transfer Monitor Advisory
  • Summary: A potential security vulnerability in SMI Transfer monitor (STM) may allow escalation of privilege. Intel is releasing microcode updates to mitigate this potential vulnerability.
  • Severity: High
• INTEL-SA-01100 – 2024.3 IPU - Intel® Xeon® Processor Advisory
  • Summary: A potential security vulnerability in some 3rd, 4th, and 5th Generation Intel® Xeon® Processors may allow escalation of privilege. Intel is releasing firmware updates to mitigate this potential vulnerability.
  • Severity: Medium
• INTEL-SA-01118 – 2024.3 IPU - 3rd Generation Intel® Xeon® Scalable Processor Advisory
  • Summary: A potential security vulnerability in some 3rd Generation Intel® Xeon® Scalable Processors may allow denial of service. Intel is releasing microcode updates to mitigate this potential vulnerability.
  • Severity: Medium
• INTEL-SA-01103 – 2024.3 IPU - Intel® Processor RAPL Interface Advisory
  • Summary: A potential security vulnerability in the Running Average Power Limit (RAPL) interface for some Intel® Processors may allow information disclosure. Intel is releasing firmware updates to mitigate this potential vulnerability.
  • Severity: Medium

Addendum to INTEL-SA-01103

Advisory Overview

Security Vulnerability in Intel RAPL Interface (CVE-2024-23984) – Supermicro has been made aware of a potential security vulnerability affecting Intel processors, identified as CVE-2024-23984. This vulnerability resides in the Running Average Power Limit (RAPL) interface, which may allow an authenticated local user to escalate privileges or disclose sensitive information by reading energy usage data.

Affected Products

This issue impacts Supermicro motherboards powered by certain Intel Xeon® processors across the X12 and X13 product families. Supermicro has collaborated with Intel to provide mitigation strategies to address this vulnerability.

Mitigation and Workarounds

After a detailed investigation we confirmed that mitigation for this issue requires both the 2024.3 IPU and the relevant Linux OS patch: Running Average Power Limit Energy Reporting

1. Apply OS Linux patch to the Linux systems
2. Apply microcode patch to all systems with Intel SGX enabled

Affected Platforms and BIOS version numbers that contain the fix:

Additional Resources

Security Advisories That Are Affecting BIOS:

• Intel Security Advisory Intel-SA-01038
  • CVE-2023-42667
• Intel Security Advisory Intel-SA-01046
  • CVE-2023-49141
• Intel Security Advisory Intel-SA-00999
  • CVE-2023-40067, CVE-2023-35061, CVE-2023-48361, CVE-2024-21844, CVE-2023-34424, CVE-2023-38655
• Intel Security Advisory Intel-SA-01083
  • CVE-2024-24853
• Intel Security Advisory Intel-SA-01100
  • CVE-2024-24980
• Intel Security Advisory Intel-SA-01118
  • CVE-2024-25939
• Intel Security Advisory Intel-SA-01103
  • CVE-2024-23984
  • Running Average Power Limit Energy Reporting CVE-2020-8694,…