Input validation error in Intel Server Platform Services Firmware and Converged Security and Management Engine (CSME) - CVE-2022-29466

Vulnerability identifier: #VU69316

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-29466

CWE-ID: CWE-20

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in firmware. A local user can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Intel Server Platform Services Firmware
Converged Security and Management Engine (CSME)
HPE ProLiant DL20 Gen9 Server SPS
HPE ProLiant ML30 Gen9 Server SPS
HPE ProLiant MicroServer Gen10 Plus
HPE ProLiant DL20 Gen10 Plus server
HPE ProLiant ML30 Gen10 Plus server
EMC Integrated Data Protection Appliance
PowerEdge T30 Mini Tower Server

Install updates from vendor's website.

Intel Server Platform Services Firmware - addressed in versions SPS_E3_04.01.04.700.0, SPS_E3_06.00.03.035.0
Converged Security and Management Engine (CSME) - addressed in versions 11.8.93, 11.12.93, 11.22.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25
HPE ProLiant DL20 Gen9 Server SPS - update to SPS_E3_04.01.04.700.0
HPE ProLiant ML30 Gen9 Server SPS - update to SPS_E3_04.01.04.700.0
HPE ProLiant MicroServer Gen10 Plus - update to SPS_E3_06.00.03.204.0
HPE ProLiant DL20 Gen10 Plus server - update to SPS_E3_06.00.03.204.0
HPE ProLiant ML30 Gen10 Plus server - update to SPS_E3_06.00.03.204.0
PowerEdge T30 Mini Tower Server - update to 1.10.0

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00610.html

• Multiple vulnerabilities in Intel Chipset Firmware
• Input validation error in Dell PowerEdge T30 Mini Tower Server
• Multiple vulnerabilities in Certain HPE ProLiant DL/ML Servers
• Multiple vulnetabilities in Dell EMC Integrated Data Protection Appliance