-------------------------------------------------------------------------
Debian LTS Advisory DLA-4098-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Tobias Frost
March 31, 2025 https://wiki.debian.org/LTS
-------------------------------------------------------------------------
Package : amd64-microcode
Version : 3.20250311.1~deb11u1
CVE ID : CVE-2024-56161
Debian Bug : 1095470
A potential vulnerability has been found for certain AMD platforms which
creates a possible confidential computing vulnerability.
AMD has released updated microcode to prevent an attacker from loading
tampered microcode.
Additionally an SEV firmware update might be required for some platforms
to support SEV-SNP attestation, which may also necessitate a BIOS
update.
For details please see the AMD security bulletin AMD-SB-3019.
CVE-2024-56161 (AMD-SB-3019):
Improper signature verification in AMD CPU ROM microcode patch
loader may allow an attacker with local administrator privileges to
load malicious CPU microcode resulting in loss of confidentiality
and integrity of a confidential guest running under AMD SEV-SNP.
For Debian 11 bullseye, this problem has been fixed in version
3.20250311.1~deb11u1.
We recommend that you upgrade your amd64-microcode packages.
For the detailed security status of amd64-microcode please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/amd64-microcode
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature