The microcode_ctl package for Red Hat Enterprise Linux 9 provides microcode updates for Intel and AMD processors. Three security vulnerabilities in UEFI firmware have been identified and fixed: CVE-2024-28047 involves improper input validation, CVE-2024-39279 concerns insufficient granularity of access control, and CVE-2024-31157 relates to improper initialization in the OutOfBandXML module. These vulnerabilities could potentially affect the security of the system's firmware update process. Red Hat has issued an update to microcode_ctl to address these issues. The advisory references Red Hat Enterprise Linux 9 and its Extended Update Support and Extended Life Cycle variants. No CVSS scores are provided in the advisory, but the impact is rated as moderate.

The vulnerabilities affect the microcode_ctl package's handling of UEFI firmware updates, potentially allowing improper input validation, insufficient access control, and improper initialization. These issues could lead to unauthorized or incorrect microcode updates, impacting system integrity. However, the advisory rates the overall security impact as moderate. There are no known exploits in the wild at the time of the advisory.

Red Hat has released an official security update for microcode_ctl addressing these vulnerabilities. Users of Red Hat Enterprise Linux 9 and its variants should apply the update as soon as possible following the instructions in the Red Hat advisory (https://access.redhat.com/articles/11258). This update mitigates the vulnerabilities by correcting input validation, access control, and initialization issues in UEFI firmware handling. No additional mitigation steps are indicated by the vendor.