Input validation error in Intel Server Platform Services Firmware and Converged Security and Management Engine (CSME) - CVE-2022-29515

Vulnerability identifier: #VU69317

CSH Severity: Low

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-29515

CWE-ID: CWE-20

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to missing release of memory after effective lifetime in firmware. A local administrator can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Intel Server Platform Services Firmware
Converged Security and Management Engine (CSME)
HPE ProLiant DL20 Gen9 Server SPS
HPE ProLiant ML30 Gen9 Server SPS
HPE ProLiant MicroServer Gen10 Plus
HPE ProLiant DL20 Gen10 Plus server
HPE ProLiant ML30 Gen10 Plus server
EMC Integrated Data Protection Appliance

Install updates from vendor's website.

Intel Server Platform Services Firmware - addressed in versions SPS_E3_04.01.04.700.0, SPS_E3_06.00.03.035.0
Converged Security and Management Engine (CSME) - addressed in versions 11.8.93, 11.12.93, 11.22.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25
HPE ProLiant DL20 Gen9 Server SPS - update to SPS_E3_04.01.04.700.0
HPE ProLiant ML30 Gen9 Server SPS - update to SPS_E3_04.01.04.700.0
HPE ProLiant MicroServer Gen10 Plus - update to SPS_E3_06.00.03.204.0
HPE ProLiant DL20 Gen10 Plus server - update to SPS_E3_06.00.03.204.0
HPE ProLiant ML30 Gen10 Plus server - update to SPS_E3_06.00.03.204.0

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00610.html

• Multiple vulnerabilities in Intel Chipset Firmware
• Multiple vulnerabilities in Certain HPE ProLiant DL/ML Servers
• Multiple vulnetabilities in Dell EMC Integrated Data Protection Appliance