Observable discrepancy in Intel Processors
Priority LOW 16CWE-203Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-203.
Summary
Observable timing discrepancy in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00383 32nd percentileScored 2026-11-07
Fix Fixed Red Hat: 19 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Intel(R) Processors | See references | — | No fix listed | CNA |
- Intel(R) Processors Vendor— Affected See references Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:intel:microcode:*:*:*:*:*:*:*:* | before 20210608 | Vulnerable | Intel |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:netapp:fas\/aff_bios:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:netapp:hci_compute_node_bios:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:netapp:solidfire_bios:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:o:intel:microcode:*:*:*:*:*:*:*:* Versions before 20210608 Vulnerable ·Intel
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:netapp:fas\/aff_bios:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:netapp:hci_compute_node_bios:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:netapp:solidfire_bios:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
Red Hat 19 advisories
- RHSA-2021:3364 Released 2021-08-31 · Red Hat rating Importantmicrocode_ctl security, bug fix and enhancement update
- Red Hat Enterprise Linux BaseOS EUS (v. 8.2) microcode_ctl-4:20191115-4.20210608.1.el8_2
- RHSA-2021:3317 Released 2021-08-31 · Red Hat rating Importantmicrocode_ctl security, bug fix and enhancement update
- Red Hat Enterprise Linux Server AUS (v. 7.6) microcode_ctl-2:2.1-47.23.el7_6
- Red Hat Enterprise Linux Server E4S (v. 7.6) microcode_ctl-2:2.1-47.23.el7_6
- Red Hat Enterprise Linux Server TUS (v. 7.6) microcode_ctl-2:2.1-47.23.el7_6
- RHSA-2021:3322 Released 2021-08-31 · Red Hat rating Importantmicrocode_ctl security, bug fix and enhancement update
- Red Hat Enterprise Linux Server AUS (v. 7.3) microcode_ctl-2:2.1-16.42.el7_3
Show 16 more Red Hat advisories
- RHSA-2021:3323 Released 2021-08-31 · Red Hat rating Importantmicrocode_ctl security, bug fix and enhancement update
- Red Hat Enterprise Linux Server AUS (v. 7.2) microcode_ctl-2:2.1-12.39.el7_2
- RHSA-2021:3255 Released 2021-08-24 · Red Hat rating Importantmicrocode_ctl security, bug fix and enhancement update
- Red Hat Enterprise Linux Server AUS (v. 7.4) microcode_ctl-2:2.1-22.41.el7_4
- Red Hat Enterprise Linux Server E4S (v. 7.4) microcode_ctl-2:2.1-22.41.el7_4
- Red Hat Enterprise Linux Server TUS (v. 7.4) microcode_ctl-2:2.1-22.41.el7_4
- RHSA-2021:3176 Released 2021-08-17 · Red Hat rating Importantmicrocode_ctl security, bug fix and enhancement update
- Red Hat Enterprise Linux BaseOS EUS (v. 8.1) microcode_ctl-4:20190618-1.20210608.1.el8_1
- RHSA-2021:3029 Released 2021-08-10 · Red Hat rating Importantmicrocode_ctl security, bug fix and enhancement update
- Red Hat Enterprise Linux ComputeNode EUS (v. 7.7) microcode_ctl-2:2.1-53.18.el7_7
- Red Hat Enterprise Linux Server EUS (v. 7.7) microcode_ctl-2:2.1-53.18.el7_7
- RHSA-2021:3028 Released 2021-08-09 · Red Hat rating Importantmicrocode_ctl security, bug fix and enhancement update
- Red Hat Enterprise Linux Client (v. 7) microcode_ctl-2:2.1-73.11.el7_9
- Red Hat Enterprise Linux Server (v. 7) microcode_ctl-2:2.1-73.11.el7_9
- Red Hat Enterprise Linux Workstation (v. 7) microcode_ctl-2:2.1-73.11.el7_9
- RHSA-2021:3027 Released 2021-08-09 · Red Hat rating Importantmicrocode_ctl security, bug fix and enhancement update
- Red Hat Enterprise Linux BaseOS (v. 8) microcode_ctl-4:20210216-1.20210608.1.el8_4
- RHSA-2021:2305 Released 2021-06-09 · Red Hat rating Importantmicrocode_ctl security, bug fix and enhancement update
- Red Hat Enterprise Linux Client (v. 7) microcode_ctl-2:2.1-73.9.el7_9
- Red Hat Enterprise Linux Server (v. 7) microcode_ctl-2:2.1-73.9.el7_9
- Red Hat Enterprise Linux Workstation (v. 7) microcode_ctl-2:2.1-73.9.el7_9
- RHSA-2021:2304 Released 2021-06-09 · Red Hat rating Importantmicrocode_ctl security, bug fix and enhancement update
- Red Hat Enterprise Linux ComputeNode EUS (v. 7.7) microcode_ctl-2:2.1-53.16.el7_7
- Red Hat Enterprise Linux Server EUS (v. 7.7) microcode_ctl-2:2.1-53.16.el7_7
- RHSA-2021:2303 Released 2021-06-09 · Red Hat rating Importantmicrocode_ctl security, bug fix and enhancement update
- Red Hat Enterprise Linux Server AUS (v. 7.6) microcode_ctl-2:2.1-47.21.el7_6
- Red Hat Enterprise Linux Server E4S (v. 7.6) microcode_ctl-2:2.1-47.21.el7_6
- Red Hat Enterprise Linux Server TUS (v. 7.6) microcode_ctl-2:2.1-47.21.el7_6
- RHSA-2021:2301 Released 2021-06-09 · Red Hat rating Importantmicrocode_ctl security, bug fix and enhancement update
- Red Hat Enterprise Linux Server AUS (v. 7.4) microcode_ctl-2:2.1-22.39.el7_4
- Red Hat Enterprise Linux Server E4S (v. 7.4) microcode_ctl-2:2.1-22.39.el7_4
- Red Hat Enterprise Linux Server TUS (v. 7.4) microcode_ctl-2:2.1-22.39.el7_4
- RHSA-2021:2308 Released 2021-06-09 · Red Hat rating Importantmicrocode_ctl security, bug fix and enhancement update
- Red Hat Enterprise Linux BaseOS (v. 8) microcode_ctl-4:20210216-1.20210525.1.el8_4
- RHSA-2021:2307 Released 2021-06-09 · Red Hat rating Importantmicrocode_ctl security, bug fix and enhancement update
- Red Hat Enterprise Linux BaseOS EUS (v. 8.2) microcode_ctl-4:20191115-4.20210525.1.el8_2
- RHSA-2021:2306 Released 2021-06-09 · Red Hat rating Importantmicrocode_ctl security, bug fix and enhancement update
- Red Hat Enterprise Linux BaseOS EUS (v. 8.1) microcode_ctl-4:20190618-1.20210525.1.el8_1
- RHSA-2021:2300 Released 2021-06-09 · Red Hat rating Importantmicrocode_ctl security, bug fix and enhancement update
- Red Hat Enterprise Linux Server AUS (v. 7.2) microcode_ctl-2:2.1-12.37.el7_2
- RHSA-2021:2302 Released 2021-06-09 · Red Hat rating Importantmicrocode_ctl security, bug fix and enhancement update
- Red Hat Enterprise Linux Server AUS (v. 7.3) microcode_ctl-2:2.1-16.40.el7_3
- RHSA-2021:2299 Released 2021-06-09 · Red Hat rating Importantmicrocode_ctl security, bug fix and enhancement update
- Red Hat Enterprise Linux Server (v. 6 ELS) microcode_ctl-2:1.17-33.33.el6_10
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Intel(R) Processors — DSA-4934
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2020-15023 Exposure of resource to wrong sphere in Intel ProcessorsPriority LOW 29
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2021:2308, RHSA-2021:3027 |
| Red Hat Enterprise Linux BaseOS EUS (v. 8.1) | Fixed | RHSA-2021:2306, RHSA-2021:3176 |
| Red Hat Enterprise Linux BaseOS EUS (v. 8.2) | Fixed | RHSA-2021:2307, RHSA-2021:3364 |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2021:2305, RHSA-2021:3028 |
| Red Hat Enterprise Linux ComputeNode EUS (v. 7.7) | Fixed | RHSA-2021:2304, RHSA-2021:3029 |
| Red Hat Enterprise Linux Server (v. 6 ELS) | Fixed | RHSA-2021:2299 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2021:2305, RHSA-2021:3028 |
| Red Hat Enterprise Linux Server AUS (v. 7.2) | Fixed | RHSA-2021:2300, RHSA-2021:3323 |
| Red Hat Enterprise Linux Server AUS (v. 7.3) | Fixed | RHSA-2021:2302, RHSA-2021:3322 |
| Red Hat Enterprise Linux Server AUS (v. 7.4) | Fixed | RHSA-2021:2301, RHSA-2021:3255 |
| Red Hat Enterprise Linux Server AUS (v. 7.6) | Fixed | RHSA-2021:2303, RHSA-2021:3317 |
| Red Hat Enterprise Linux Server E4S (v. 7.4) | Fixed | RHSA-2021:2301, RHSA-2021:3255 |
| Red Hat Enterprise Linux Server E4S (v. 7.6) | Fixed | RHSA-2021:2303, RHSA-2021:3317 |
| Red Hat Enterprise Linux Server EUS (v. 7.7) | Fixed | RHSA-2021:2304, RHSA-2021:3029 |
| Red Hat Enterprise Linux Server TUS (v. 7.4) | Fixed | RHSA-2021:2301, RHSA-2021:3255 |
| Red Hat Enterprise Linux Server TUS (v. 7.6) | Fixed | RHSA-2021:2303, RHSA-2021:3317 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2021:2305, RHSA-2021:3028 |
Timeline
- 2026-10-02 Threatist record created from CVE-2020-24512
- 2026-10-03 Alias added: GHSA-7hm5-8cp5-vqp5
- 2026-10-08 CISA SSVC decision points changed
References
Advisory 5
Sources
- CVE-2020-24512 · CVE Program
- CVE-2020-24512 · NVD
- FIRST EPSS
- GHSA-7hm5-8cp5-vqp5 · GitHub Advisory Database · CC BY 4.0
- CVE-2020-24512 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences