low 3.3

CVE-2020-24512 json

Observable timing discrepancy in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via…

published 2021-06-09 5y ago modified 2026-10-08 last mo. also EUVD-2020-17232

cvss: 3.3; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 30%
public exploits: 0; none known

Observable timing discrepancy in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

Patch / fix

fixed in 1 distros 7

intel microcode 20210608

debian ubuntu red hat suse opensuse rocky linux arch linux

intel-microcode Debian 14, Debian 13, Debian 12 3.20210608.1

debian advisories DEBIAN-CVE-2020-24512

intel-microcode Ubuntu 18.04 LTS 3.20210608.0ubuntu0.18.04.1
intel-microcode Ubuntu 20.04 LTS 3.20210608.0ubuntu0.20.04.1
intel-microcode Ubuntu Pro 14.04 LTS 3.20210608.0ubuntu0.14.04.1+esm1
intel-microcode Ubuntu Pro 16.04 LTS 3.20210608.0ubuntu0.16.04.1+esm1

ubuntu advisories UBUNTU-CVE-2020-24512

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

microcode_ctl RHEL 8 4:20210216-1.20210525.1.el8_4
microcode_ctl RHEL 7 2:2.1-73.9.el7_9
microcode_ctl RHEL 7 2:2.1-73.11.el7_9
microcode_ctl RHEL 8 4:20210216-1.20210608.1.el8_4
microcode_ctl RHEL 8.2 EUS 4:20191115-4.20210525.1.el8_2
microcode_ctl RHEL 7.3 AUS 2:2.1-16.42.el7_3
microcode_ctl RHEL 7.2 AUS 2:2.1-12.39.el7_2
microcode_ctl RHEL 7.7 EUS 2:2.1-53.16.el7_7

red hat advisories RHSA-2021:2307 RHSA-2021:2308 RHSA-2021:3322 RHSA-2021:3323 RHSA-2021:2304 RHSA-2021:2303

microcode_ctl SLES 11 SP4-LTSS, SLE Point of Sale 11 SP3 1.17-102.83.71.1
ucode-intel SLE Module for Basesystem 15 SP3, SLE Module for Basesystem 15 SP2, SLE Micro 5.0 20210525-7.1
ucode-intel SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLES 15 SP1-BCL +6 more 20210525-3.203.1
ucode-intel SLES for SAP 15, SLE High Performance Computing 15-LTSS, SLE High Performance Computing 15-ESPOS 20210525-3.67.1
ucode-intel SLES for SAP 12 SP4, SLES for SAP 12 SP3, SLES 12 SP4-LTSS +8 more 20210525-13.90.1
ucode-intel SLES for SAP 12 SP5, SLES 12 SP5 20210525-3.35.1

suse advisories SUSE-SU-2021:14758-1 SUSE-SU-2021:1933-1 SUSE-SU-2021:1932-1 SUSE-SU-2021:1931-1 SUSE-SU-2021:1930-1 SUSE-SU-2021:1929-1

ucode-intel openSUSE Tumbleweed 20210608-1.2
ucode-intel openSUSE Leap 15.3 20210525-7.1
ucode-intel openSUSE Leap 15.2 20210525-lp152.2.17.1

opensuse advisories openSUSE-SU-2024:11478-1 openSUSE-SU-2021:1933-1 openSUSE-SU-2021:0876-1

microcode_ctl Rocky Linux 8 4:20210216-1.20210608.1.el8_4
microcode_ctl Rocky Linux 8 4:20210216-1.20210525.1.el8_4

rocky linux advisories RLSA-2021:3027 RLSA-2021:2308

intel-ucode Arch Linux 20210608-1

arch linux advisories AVG-2051

Is CVE-2020-24512 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-24512 updated 2026-10-08 cvss 2.8

hw: observable timing discrepancy in some Intel Processors

Red Hat Enterprise Linux BaseOS (v. 8) microcode_ctl 20210216-1.20210525.1.el8_4, microcode_ctl 20210216-1.20210608.1.el8_4
fixed: vendor fix RHSA-2021:2308
Red Hat Enterprise Linux BaseOS EUS (v. 8.1) microcode_ctl 20190618-1.20210525.1.el8_1, microcode_ctl 20190618-1.20210608.1.el8_1
fixed: vendor fix RHSA-2021:2306
Red Hat Enterprise Linux BaseOS EUS (v. 8.2) microcode_ctl 20191115-4.20210525.1.el8_2, microcode_ctl 20191115-4.20210608.1.el8_2
fixed: vendor fix RHSA-2021:2307
Red Hat Enterprise Linux Client (v. 7) microcode_ctl 2.1-73.9.el7_9, microcode_ctl 2.1-73.11.el7_9
fixed: vendor fix RHSA-2021:3028
Red Hat Enterprise Linux ComputeNode EUS (v. 7.7) microcode_ctl 2.1-53.16.el7_7, microcode_ctl 2.1-53.18.el7_7
fixed: vendor fix RHSA-2021:2304
Red Hat Enterprise Linux Server (v. 6 ELS) microcode_ctl 1.17-33.33.el6_10
fixed: vendor fix RHSA-2021:2299
Red Hat Enterprise Linux Server (v. 7) microcode_ctl 2.1-73.9.el7_9, microcode_ctl 2.1-73.11.el7_9
fixed: vendor fix RHSA-2021:3028
Red Hat Enterprise Linux Server AUS (v. 7.2) microcode_ctl 2.1-12.37.el7_2, microcode_ctl 2.1-12.39.el7_2
fixed: vendor fix RHSA-2021:2300

show 9 more

Red Hat Enterprise Linux Server AUS (v. 7.3) microcode_ctl 2.1-16.40.el7_3, microcode_ctl 2.1-16.42.el7_3
fixed: vendor fix RHSA-2021:2302
Red Hat Enterprise Linux Server AUS (v. 7.4) microcode_ctl 2.1-22.39.el7_4, microcode_ctl 2.1-22.41.el7_4
fixed: vendor fix RHSA-2021:2301
Red Hat Enterprise Linux Server AUS (v. 7.6) microcode_ctl 2.1-47.21.el7_6, microcode_ctl 2.1-47.23.el7_6
fixed: vendor fix RHSA-2021:2303
Red Hat Enterprise Linux Server E4S (v. 7.4) microcode_ctl 2.1-22.39.el7_4, microcode_ctl 2.1-22.41.el7_4
fixed: vendor fix RHSA-2021:2301
Red Hat Enterprise Linux Server E4S (v. 7.6) microcode_ctl 2.1-47.21.el7_6, microcode_ctl 2.1-47.23.el7_6
fixed: vendor fix RHSA-2021:2303
Red Hat Enterprise Linux Server EUS (v. 7.7) microcode_ctl 2.1-53.16.el7_7, microcode_ctl 2.1-53.18.el7_7
fixed: vendor fix RHSA-2021:2304
Red Hat Enterprise Linux Server TUS (v. 7.4) microcode_ctl 2.1-22.39.el7_4, microcode_ctl 2.1-22.41.el7_4
fixed: vendor fix RHSA-2021:2301
Red Hat Enterprise Linux Server TUS (v. 7.6) microcode_ctl 2.1-47.21.el7_6, microcode_ctl 2.1-47.23.el7_6
fixed: vendor fix RHSA-2021:2303
Red Hat Enterprise Linux Workstation (v. 7) microcode_ctl 2.1-73.9.el7_9, microcode_ctl 2.1-73.11.el7_9
fixed: vendor fix RHSA-2021:3028

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-21-222-05 updated 2024-02-13 cvss 2.8

Siemens Industrial Products Intel CPUs (Update F)

Siemens SIMATIC Field PG M5 <V22.01.10
affected: fixed in V22.01.10, mitigation support.industry.siemens.com
Siemens SIMATIC Field PG M6 <V26.01.08
affected: fixed in V26.01.08, mitigation support.industry.siemens.com
Siemens SIMATIC IPC347G <V01.04.00
affected: fixed in V01.04.00, mitigation support.industry.siemens.com
Siemens SIMATIC IPC427E <V21.01.16 Siemens SIMATIC IPC477E <V21.01.16 Siemens SIMATIC IPC477E Pro <V21.01.16
affected: fixed in V21.01.16, mitigation support.industry.siemens.com
Siemens SIMATIC IPC527G <V1.4.3
affected: fixed in V1.4.3, mitigation support.industry.siemens.com
Siemens SIMATIC IPC547G
affected: mitigation, no fix planned
Siemens SIMATIC IPC627E <BIOS_V25.02.10 Siemens SIMATIC IPC647E <BIOS_V25.02.10 Siemens SIMATIC IPC677E <BIOS_V25.02.10 Siemens SIMATIC IPC847E <BIOS_V25.02.10
affected: fixed in V25.02.10, mitigation support.industry.siemens.com
Siemens SIMATIC IPC3000 SMART V3 <V01.04.00
affected: fixed in V01.04.00, mitigation support.industry.siemens.com

show 6 more

Siemens SIMATIC ITP1000 <V23.01.10
affected: fixed in V23.01.10, mitigation support.industry.siemens.com
Siemens SINUMERIK 828D HW PU.4 <V08.00.00.00
affected: fixed in V08.00.00.00, mitigation
Siemens SINUMERIK MC MCU 1720 <V05.00.00.00
affected: fixed in V05.00.00.00, mitigation
Siemens SINUMERIK ONE / SINUMERIK 840D sl Handheld Terminal HT 10 <V08.00.00.00
affected: fixed in V08.00.00.00, mitigation
Siemens SINUMERIK ONE NCU 1740 <V05.00.00.00
affected: fixed in V05.00.00.00, mitigation
Siemens SINUMERIK ONE PPU 1740 <V06.00.00.00
affected: fixed in V06.00.00.00, mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-23-122-01 updated 2023-05-02 cvss 3.3

Mitsubishi Electric Factory Automation Products

Mitsubishi Electric MELIPC MI1002-W Mitsubishi Electric MELIPC MI2012-W Mitsubishi Electric MELIPC MI3315G-W Mitsubishi Electric MELIPC MI3321G-W Mitsubishi Electric MELIPC MI5122-VM Mitsubishi Electric MELSEC iQ-R R102WCPU-W

+4 more productsfewer

Mitsubishi Electric MELSEC Q Q24DHCCPU-LS Mitsubishi Electric MELSEC Q Q24DHCCPU-V Mitsubishi Electric MELSEC Q Q24DHCCPU-VG Mitsubishi Electric MELSEC Q Q26DHCCPU-LS

affected: vendor fix intel.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: last mo. (2026-10-08)

Exploit prediction

0.37% chance of exploitation in the next 30 days, higher than 30% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.1	3.3	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD	2.0	2.1	AV:L/AC:L/Au:N/C:P/I:N/A:N

Affected products

n/a Intel(R) Processors

Classification

Weakness

CWE-203 Observable Discrepancy

References

debian.org /security/2021/dsa-4934
vendor-advisory, third-party-advisory
intel.com /content/www/us/en/security-center/advisory/intel-sa-00464.html
vendor-advisory
security.netapp.com /advisory/ntap-20210611-0005/
third-party-advisory
lists.debian.org /debian-lts-announce/2021/07/msg00022.html
mailing-list, third-party-advisory
cert-portal.siemens.com /productcert/pdf/ssa-309571.pdf
third-party-advisory

Sources

CVE List CVE-2020-24512
NVD CVE-2020-24512

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

json all entries feed