--- id: CVE-2020-24512 title: >- Observable timing discrepancy in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. summary: >- Observable timing discrepancy in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. severity: low cvss: 3.3 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N' cwe: - CWE-203 - CWE-200 vendor: intel product: microcode affected: - microcode < 20210608 - debian_linux = 10.0 - fas/aff_bios - hci_compute_node_bios - solidfire_bios patched: - microcode 20210608 published: '2021-06-09' updated: '2026-10-08' sourceUpdated: '2026-10-08T21:17:25.730' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2020-24512' references: - url: 'https://cert-portal.siemens.com/productcert/pdf/ssa-309571.pdf' label: secure@intel.com - url: 'https://lists.debian.org/debian-lts-announce/2021/07/msg00022.html' label: secure@intel.com - url: 'https://security.netapp.com/advisory/ntap-20210611-0005/' label: secure@intel.com - url: 'https://www.debian.org/security/2021/dsa-4934' label: secure@intel.com - url: >- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html label: secure@intel.com - url: 'https://cert-portal.siemens.com/productcert/pdf/ssa-309571.pdf' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2021/07/msg00022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20210611-0005/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.debian.org/security/2021/dsa-4934' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-24512.json - url: 'https://access.redhat.com/security/cve/CVE-2020-24512' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1962722' - url: 'https://www.cve.org/CVERecord?id=CVE-2020-24512' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2020-24512' - url: 'https://access.redhat.com/errata/RHSA-2021:2299' - url: 'https://access.redhat.com/errata/RHSA-2021:3028' - url: 'https://access.redhat.com/errata/RHSA-2021:2305' - url: 'https://access.redhat.com/errata/RHSA-2021:2304' - url: 'https://access.redhat.com/errata/RHSA-2021:3029' - url: 'https://access.redhat.com/errata/RHSA-2021:2300' - url: 'https://access.redhat.com/errata/RHSA-2021:3323' - url: 'https://access.redhat.com/errata/RHSA-2021:2302' - url: 'https://access.redhat.com/errata/RHSA-2021:3322' - url: 'https://access.redhat.com/errata/RHSA-2021:2301' - url: 'https://access.redhat.com/errata/RHSA-2021:3255' - url: 'https://access.redhat.com/errata/RHSA-2021:2303' - url: 'https://access.redhat.com/errata/RHSA-2021:3317' - url: 'https://access.redhat.com/errata/RHSA-2021:2306' - url: 'https://access.redhat.com/errata/RHSA-2021:3176' - url: 'https://access.redhat.com/errata/RHSA-2021:2307' - url: 'https://access.redhat.com/errata/RHSA-2021:3364' - url: 'https://access.redhat.com/errata/RHSA-2021:2308' - url: 'https://access.redhat.com/errata/RHSA-2021:3027' tags: - nvd - csaf - vex - red-hat - cve.org epss: 0.00383 epssPercentile: 0.32163 ingestedAt: '2026-10-08T22:11:53.734Z' scores: nvd: 3.3 vendor: 2.8 ssvc: exploitation: none automatable: 'no' technicalImpact: partial timestamp: '2026-10-08T21:02:13.466516Z' --- ## Overview Observable timing discrepancy in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. ## Affected - `microcode < 20210608` - `debian_linux = 10.0` - `fas/aff_bios` - `hci_compute_node_bios` - `solidfire_bios` ## Remediation Upgrade past the affected range: - `microcode 20210608` ## Vendor advisories - **RHSA-2021:2299** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 6 ELS) · released 2021-06-09 · [advisory](https://access.redhat.com/errata/RHSA-2021:2299) - **RHSA-2021:3028** · Red Hat · fixed in: Red Hat Enterprise Linux Client (v. 7), Red Hat Enterprise Linux Server (v. 7), Red Hat Enterprise Linux Workstation (v. 7) · released 2021-08-09 · [advisory](https://access.redhat.com/errata/RHSA-2021:3028) - **RHSA-2021:2305** · Red Hat · fixed in: Red Hat Enterprise Linux Client (v. 7), Red Hat Enterprise Linux Server (v. 7), Red Hat Enterprise Linux Workstation (v. 7) · released 2021-06-09 · [advisory](https://access.redhat.com/errata/RHSA-2021:2305) - **RHSA-2021:2304** · Red Hat · fixed in: Red Hat Enterprise Linux ComputeNode EUS (v. 7.7), Red Hat Enterprise Linux Server EUS (v. 7.7) · released 2021-06-09 · [advisory](https://access.redhat.com/errata/RHSA-2021:2304) - **RHSA-2021:3029** · Red Hat · fixed in: Red Hat Enterprise Linux ComputeNode EUS (v. 7.7), Red Hat Enterprise Linux Server EUS (v. 7.7) · released 2021-08-10 · [advisory](https://access.redhat.com/errata/RHSA-2021:3029) - **RHSA-2021:2300** · Red Hat · fixed in: Red Hat Enterprise Linux Server AUS (v. 7.2) · released 2021-06-09 · [advisory](https://access.redhat.com/errata/RHSA-2021:2300) - **RHSA-2021:3323** · Red Hat · fixed in: Red Hat Enterprise Linux Server AUS (v. 7.2) · released 2021-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2021:3323) - **RHSA-2021:2302** · Red Hat · fixed in: Red Hat Enterprise Linux Server AUS (v. 7.3) · released 2021-06-09 · [advisory](https://access.redhat.com/errata/RHSA-2021:2302) - **RHSA-2021:3322** · Red Hat · fixed in: Red Hat Enterprise Linux Server AUS (v. 7.3) · released 2021-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2021:3322) - **RHSA-2021:2301** · Red Hat · fixed in: Red Hat Enterprise Linux Server AUS (v. 7.4), Red Hat Enterprise Linux Server E4S (v. 7.4), Red Hat Enterprise Linux Server TUS (v. 7.4) · released 2021-06-09 · [advisory](https://access.redhat.com/errata/RHSA-2021:2301) - **RHSA-2021:3255** · Red Hat · fixed in: Red Hat Enterprise Linux Server AUS (v. 7.4), Red Hat Enterprise Linux Server E4S (v. 7.4), Red Hat Enterprise Linux Server TUS (v. 7.4) · released 2021-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2021:3255)