CVE-2023-47855: Input Validation

Q: What is the severity of CVE-2023-47855?

CVE-2023-47855 is classified as a potential escalation of privilege vulnerability due to improper input validation.

Q: How do I fix CVE-2023-47855?

To fix CVE-2023-47855, you should update the Intel microcode to the versions specified as remedies for your respective Ubuntu or Debian operating systems.

Q: What software is affected by CVE-2023-47855?

CVE-2023-47855 affects Intel TDX module software prior to version 1.5.05.46.698 and specific versions of the Intel microcode on various distributions.

Q: Can a guest user exploit CVE-2023-47855?

CVE-2023-47855 can potentially be exploited by a privileged user with local access, leading to escalated privileges.

Q: Is there a specific patch available for CVE-2023-47855?

Yes, specific patches are available in the form of updated Intel microcode packages for vulnerable versions.

Published May 16, 2024

Updated

Improper input validation in some Intel(R) TDX module software before version 1.5.05.46.698 may allow a privileged user to potentially enable escalation of privilege via local access.

Affected Software

9 affected componentsFixes available

ubuntu/intel-microcode<3.20240514.0ubuntu0.18.04.1+

3.20240514.0ubuntu0.18.04.1+

ubuntu/intel-microcode<3.20240514.0ubuntu0.20.04.1

3.20240514.0ubuntu0.20.04.1

ubuntu/intel-microcode<3.20240514.0ubuntu0.22.04.1

3.20240514.0ubuntu0.22.04.1

ubuntu/intel-microcode<3.20240514.0ubuntu0.23.10.1

3.20240514.0ubuntu0.23.10.1

ubuntu/intel-microcode<3.20240514.0ubuntu0.24.04.1

3.20240514.0ubuntu0.24.04.1

ubuntu/intel-microcode<3.20240514.0ubuntu0.16.04.1+

3.20240514.0ubuntu0.16.04.1+

debian/intel-microcode<=3.20231114.1~deb11u1, <=3.20231114.1~deb12u1

3.20240514.1~deb11u13.20240514.1~deb12u13.20240813.2

Intel TDX module<1.5.05.46.698

NetApp Hci Compute Node Bios

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/intel-microcode to a version that resolves this vulnerability.
Fixed in 3.20240514.0ubuntu0.18.04.1+
Upgrade
Upgrade ubuntu/intel-microcode to a version that resolves this vulnerability.
Fixed in 3.20240514.0ubuntu0.20.04.1
Upgrade
Upgrade ubuntu/intel-microcode to a version that resolves this vulnerability.
Fixed in 3.20240514.0ubuntu0.22.04.1
Upgrade
Upgrade ubuntu/intel-microcode to a version that resolves this vulnerability.
Fixed in 3.20240514.0ubuntu0.23.10.1
Upgrade
Upgrade ubuntu/intel-microcode to a version that resolves this vulnerability.
Fixed in 3.20240514.0ubuntu0.24.04.1
Upgrade
Upgrade ubuntu/intel-microcode to a version that resolves this vulnerability.
Fixed in 3.20240514.0ubuntu0.16.04.1+
Upgrade
Upgrade debian/intel-microcode to a version that resolves this vulnerability.
Fixed in 3.20240514.1~deb11u1Fixed in 3.20240514.1~deb12u1Fixed in 3.20240813.2
Upgrade
Upgrade Intel(R) TDX module software to a version that resolves this vulnerability.
Fixed in 1.5.05.46.698

Event History

May 16, 2024

CVE Published

via Ubuntu·12:00 AM

CVE Published

via MITRE·08:47 PM

Data Sourced

via MITRE·08:47 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:16 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:16 PM

Affected Software

Jun 30, 2024

Data Sourced

via Launchpad·12:52 PM

Description

Parent advisories

This vulnerability appears in the following advisories.

USN-6797-1

Frequently Asked Questions

What is the severity of CVE-2023-47855?

CVE-2023-47855 is classified as a potential escalation of privilege vulnerability due to improper input validation.

How do I fix CVE-2023-47855?

To fix CVE-2023-47855, you should update the Intel microcode to the versions specified as remedies for your respective Ubuntu or Debian operating systems.

What software is affected by CVE-2023-47855?

CVE-2023-47855 affects Intel TDX module software prior to version 1.5.05.46.698 and specific versions of the Intel microcode on various distributions.

Can a guest user exploit CVE-2023-47855?

CVE-2023-47855 can potentially be exploited by a privileged user with local access, leading to escalated privileges.

Is there a specific patch available for CVE-2023-47855?

Yes, specific patches are available in the form of updated Intel microcode packages for vulnerable versions.

CVE-2023-47855: Input Validation

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What is the severity of CVE-2023-47855?

How do I fix CVE-2023-47855?

What software is affected by CVE-2023-47855?

Can a guest user exploit CVE-2023-47855?

Is there a specific patch available for CVE-2023-47855?

Company

Resources

Contact