A potential security vulnerability in some 3rd Generation Intel® Xeon® Scalable Processors may allow information disclosure. Intel is releasing firmware updates to mitigate this potential vulnerability.
CVEID: CVE-2022-33972
Description: Incorrect calculation in microcode keying mechanism for some 3rd Generation Intel® Xeon® Scalable Processors may allow a privileged user to potentially enable information disclosure via local access.
CVSS Base Score: 6.1 Medium
CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N
Product Collection
|
Vertical Segment
|
CPU ID
|
Platform ID
—|—|—|—
3rd Gen Intel® Xeon® Scalable processor family
|
Server
|
606A6
|
0x87
Intel recommends that users of affected 3rd Generation Intel® Xeon® Scalable Processors update to the latest version of firmware provided by the system manufacturer that addresses these issues.
Intel has released microcode updates for the affected Intel® Processors that are currently supported on the public github repository. Please see details below on access to the microcode:
GitHub*: Public Github: <https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files>__
Details on the microcode loading points can be found at:
This CVE requires a Microcode Security Version Number (SVN) update. To address this vulnerability, a SGX TCB recovery is planned, refer here for more information on the SGX TCB recovery process.
Intel would like to thank Microsoft for reporting this issue.
Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are available.