intel-microcode vulnerabilities

2023-02-2705:12:38

Google

osv.dev

6.8 Medium

CVSS3

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

6.4 Medium

AI Score

Confidence

Low

4.7 Medium

CVSS2

Access Vector

ADJACENT_NETWORK

Access Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:A/AC:L/Au:M/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

8.4%

JSON

Erik C. Bjorge discovered that some Intel® Atom and Intel Xeon Scalable
Processors did not properly implement access controls for out-of-band
management. This may allow a privileged network-adjacent user to potentially
escalate privileges. (CVE-2022-21216)

Cfir Cohen, Erdem Aktas, Felix Wilhelm, James Forshaw, Josh Eads, Nagaraju
Kodalapura Nagabhushana Rao, Przemyslaw Duda, Liron Shacham and Ron Anderson
discovered that some Intel® Xeon® Processors used incorrect default
permissions in some memory controller configurations when using Intel®
Software Guard Extensions. This may allow a privileged local user to potentially
escalate privileges. (CVE-2022-33196)

It was discovered that some 3rd Generation Intel® Xeon® Scalable Processors
did not properly calculate microkey keying. This may allow a privileged local
user to potentially disclose information. (CVE-2022-33972)

Joseph Nuzman discovered that some Intel® Processors when using Intel®
Software Guard Extensions did not properly isolate shared resources. This may
allow a privileged local user to potentially disclose
information. (CVE-2022-38090)