Input validation error in Intel Xeon Processor E5 v3 Family and Intel Xeon Processor E5 v4 Family - CVE-2022-26006

Vulnerability identifier: #VU69115

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-26006

CWE-ID: CWE-20

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insufficient validation of user-supplied input in the BIOS firmware. A local user can run a specially crafted program to escalate privileges on the system.

Intel Xeon Processor E5 v3 Family
Intel Xeon Processor E5 v4 Family
HPE ProLiant ML30 Gen10 Plus server
HPE ProLiant MicroServer Gen10 Plus
HPE ProLiant DL20 Gen10 Plus server
HPE ProLiant m510 Server Cartridge
HPE ProLiant XL730f Gen9 Server
HPE StoreVirtual 3000 File Controller
HPE ProLiant XL750f Gen9 Server
HPE ProLiant XL740f Gen9 Server
HPE Synergy 660 Gen9 Compute Module
HPE Synergy 480 Gen9 Compute Module
StoreVirtual 3000 Storage
HPE 3PAR StoreServ File Controller v3 System
HPE StoreEasy 1650 Expanded Storage
HPE StoreEasy 3850 Gateway Storage
HPE StoreEasy 1850 Storage
HPE StoreEasy 1650 Storage
HPE StoreEasy 1550 Storage
HPE StoreEasy 1450 Storage
HPE ProLiant XL270d Gen9 Accelerator Tray 2U Configure
HPE ProLiant BL460c Gen9 Server Blade
ProLiant BL480c Server Blade
HPE ProLiant BL660c Gen9 Server
HPE ProLiant DL60 Gen9 Server
HPE ProLiant DL80 Gen9 Server
HPE ProLiant DL160 Gen9 Server
HPE ProLiant DL180 Gen9 Server
HPE ProLiant DL120 Gen9 Server
HPE ProLiant DL360 Gen9 Server
HPE ProLiant DL380 Gen9 Server
HPE ProLiant DL560 Gen9 Server
HPE ProLiant ML110 Gen9 Server
HP ProLiant ML150 Gen9 Server
HPE ProLiant ML350 Gen9 Server
SimpliVity 380 Gen9
EMC Integrated Data Protection Appliance

Install updates from vendor's website.

HPE ProLiant ML30 Gen10 Plus server - update to 1.64_10-20-2022
HPE ProLiant MicroServer Gen10 Plus - update to 1.64_10-20-2022
HPE ProLiant DL20 Gen10 Plus server - update to 1.64_10-20-2022
HPE ProLiant m510 Server Cartridge - update to 1.96_10-13-2022
HPE ProLiant XL730f Gen9 Server - update to 3.04_08-04-2022
HPE StoreVirtual 3000 File Controller - update to 3.04_08_04_2022
HPE ProLiant XL750f Gen9 Server - update to 3.04_08-04-2022
HPE ProLiant XL740f Gen9 Server - update to 3.04_08-04-2022
HPE Synergy 660 Gen9 Compute Module - update to 3.04_08-04-2022
HPE Synergy 480 Gen9 Compute Module - update to 3.04_08-04-2022
StoreVirtual 3000 Storage - update to 3.04_08_04_2022
HPE 3PAR StoreServ File Controller v3 System - update to 3.04_08_04_2022
HPE StoreEasy 1650 Expanded Storage - update to 3.04_08_04_2022
HPE StoreEasy 3850 Gateway Storage - update to 3.04_08_04_2022
HPE StoreEasy 1850 Storage - update to 3.04_08_04_2022
HPE StoreEasy 1650 Storage - update to 3.04_08_04_2022
HPE StoreEasy 1550 Storage - update to 3.04_08_04_2022
HPE StoreEasy 1450 Storage - update to 3.04_08_04_2022
HPE ProLiant XL270d Gen9 Accelerator Tray 2U Configure - update to 3.04_08-04-2022
HPE ProLiant BL460c Gen9 Server Blade - update to 3.04_08-04-2022
ProLiant BL480c Server Blade - update to 3.04_08-04-2022
HPE ProLiant BL660c Gen9 Server - update to 3.04_08-04-2022
HPE ProLiant DL60 Gen9 Server - update to 3.04_08-04-2022
HPE ProLiant DL80 Gen9 Server - update to 3.04_08-04-2022
HPE ProLiant DL160 Gen9 Server - update to 3.04_08-04-2022
HPE ProLiant DL180 Gen9 Server - update to 3.04_08-04-2022
HPE ProLiant DL120 Gen9 Server - update to 3.04_08-04-2022
HPE ProLiant DL360 Gen9 Server - update to 3.04_08-04-2022
HPE ProLiant DL380 Gen9 Server - update to 3.04_08-04-2022
HPE ProLiant DL560 Gen9 Server - update to 3.04_08-04-2022
HPE ProLiant ML110 Gen9 Server - update to 3.04_08-04-2022
HP ProLiant ML150 Gen9 Server - update to 3.04_08-04-2022
HPE ProLiant ML350 Gen9 Server - update to 3.04_08-04-2022
SimpliVity 380 Gen9 - update to 2023_0110

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00688.html

• Privilege escalation in Intel BIOS firmware
• Input validation error in Certain HPE SimpliVity 380 Gen9 Servers
• Multiple vulnerabilities in Certain HPE ProLiant BL/DL/ML Servers
• Input validation error in Certain HPE Apollo Servers
• Input validation error in Certain HPE Synergy Servers
• Multiple vulnerabilities in Certain HPE ProLiant Moonshot Servers
• Input validation error in Certain HPE StoreEasy Servers
• Multiple vulnetabilities in Dell EMC Integrated Data Protection Appliance