2023.3 IPU - Intel® Xeon® Processor Advisory

Summary:

A potential security vulnerability in some Intel® Xeon® Processors with Intel® Software Guard Extensions (SGX) may allow escalation of privilege. Intel is releasing firmware updates to mitigate this potential vulnerability.

Vulnerability Details:

CVEID: CVE-2022-41804

Description: Unauthorized error injection in Intel® SGX or Intel® TDX for some Intel® Xeon® Processors may allow a privileged user to potentially enable escalation of privilege via local access.

CVSS Base Score: 7.2 High

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:H****

Affected Products:

Product Collection

|

Vertical Segment

|

CPU ID

|

Platform ID

|

Mitigation Type

—|—|—|—|—

3rd Gen Intel® Xeon® Scalable Processor family

|

Server

|

606A6

|

0x87

|

Microcode, BIOS

Intel® Xeon® D Processors

|

Server

|

606C1

|

01

|

Microcode, BIOS

4th Generation Intel® Xeon® Scalable Processors

|

Server

|

0x806f8

|

0x87

|

Microcode

Recommendations:

Intel is releasing BIOS and microcode updates for the affected processors.

For the mitigation to be effective for Intel® SGX enabled systems, Intel recommends updating the microcode patch located in platform flash designated by firmware interface table (FIT) entry type1.
Details on the microcode loading points can be found at:
<https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/secure-coding/loading-microcode-os.html&gt;

When the microcode update is applied via the FIT table the BIOS must also be updated. If the BIOS is not updated to the latest version with the microcode update when Intel® SGX is enabled, the system will hang. Loading this microcode update via the operating system is acceptable but will not provide the mitigation for this Intel® SGX issue.

For non-Intel® (SGX) systems the microcode patch can be OS loaded.

Intel has released microcode updates for the affected Intel® Processors that are currently supported on the public github repository. Please see details below on access to the microcode:
GitHub*: Public Github: <https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files&gt;

This CVE requires a Microcode Security Version Number (SVN) update. To address this vulnerability, a SGX TCB recovery is planned, refer here for more information on the SGX TCB recovery process.

Acknowledgements:

This issue was found internally by Intel employees.****

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are available.