CVE-2023-23583: microcode_ctl

Title

CVE-2023-23583: microcode_ctl: Intel CPUs: execution of MOVSB instructions with redundant REX prefix leads to unintended system behavior

Summary

As described by Intel:

Under certain microarchitectural conditions, Intel has identified cases where execution of an instruction (REP MOVSB) encoded with a redundant REX prefix may result in unpredictable system behavior resulting in a system crash/hang, or, in some limited scenarios, may allow escalation of privilege from CPL3 to CPL0.

and by Red Hat:

A security vulnerability was found in some Intel processors. Execution of REP MOVSB instructions with a redundant REX prefix may result in execution continuing at an incorrect EIP address after a micro-architectural event occurs, potentially allowing privilege escalation, information disclosure and/or a denial of service via local access.

as well as in CVE-2023-23583.

More detail is available via these links to Intel's website and in the public disclosure by Tavis Ormandy from Google.

Public disclosure date: November 14, 2023

EL9

• Fixed in version: 4:20231114-1.el9_2.security available November 15, 2023

EL8

• Fixed in version 4:20230808-2.20231009.1.el8.security available November 19, 2023

Please refer to our override package of microcode_ctl.