VMware Tanzu Isolation Segment update for Intel Microcode



Published: 2023-05-26
Risk Low
Patch available YES
Number of vulnerabilities 4
CVE-ID CVE-2022-21216
CVE-2022-33196
CVE-2022-33972
CVE-2022-38090
CWE-ID CWE-284
CWE-276
CWE-682
CWE-653
Exploitation vector Local network
Public exploit N/A
Vulnerable software
Subscribe 		Isolation Segment
Server applications / Other server solutions

Vendor VMware, Inc

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Improper access control

EUVDB-ID: #VU72448

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-21216

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in out-of-band management in Intel processors. A remote privileged user on the local network can bypass implemented security restrictions and gain unauthorized access to the application.

Mitigation

Install update from vendor's website.

Vulnerable software versions All versions
CPE2.3 External links

http://tanzu.vmware.com/security/usn-5886-1


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

2) Incorrect default permissions

EUVDB-ID: #VU72456

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-33196

CWE-ID: CWE-276 - Incorrect Default Permissions

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions for memory controller configurations for some Intel Xeon processors when using Intel Software Guard Extensions. A local user escalate privileges on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions All versions
CPE2.3 External links

http://tanzu.vmware.com/security/usn-5886-1


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

3) Incorrect calculation

EUVDB-ID: #VU72477

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-33972

CWE-ID: CWE-682 - Incorrect Calculation

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to incorrect calculation in microcode keying mechanism. A local user can gain access to sensitive information.

Mitigation

Install update from vendor's website.

Vulnerable software versions All versions
CPE2.3 External links

http://tanzu.vmware.com/security/usn-5886-1


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

4) Improper isolation or compartmentalization

EUVDB-ID: #VU72457

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-38090

CWE-ID: CWE-653 - Improper isolation or compartmentalization

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to improper isolation of shared resources in some Intel processors when using Intel Software Guard Extensions. A local user can gain access to sensitive information.

Mitigation

Install update from vendor's website.

Vulnerable software versions All versions
CPE2.3 External links

http://tanzu.vmware.com/security/usn-5886-1


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###