Use-after-free in 3rd Generation Intel Xeon Scalable Processors - CVE-2022-30539

Vulnerability identifier: #VU72450

CSH Severity: Low

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-30539

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in the BIOS firmware. A local user can execute arbitrary code with elevated privileges.

3rd Generation Intel Xeon Scalable Processors
PowerEdge T150
PowerEdge R250
PowerEdge T350
PowerEdge R350
PowerEdge R750XA
PowerEdge R750
PowerEdge XR12
PowerEdge XR11
PowerEdge R650XS
PowerEdge R450
PowerEdge T550
PowerEdge R550
PowerEdge MX750c
PowerEdge C6520
PowerEdge R650
PowerEdge R750XS
PowerEdge T340
PowerEdge T140
PowerEdge R240
PowerEdge R340
PowerEdge XE7440
PowerEdge T440
PowerEdge XE7420
PowerEdge XE2420
PowerEdge DSS8440
PowerEdge C4140
PowerEdge MX840C
PowerEdge MX740C
PowerEdge M640P
PowerEdge M640
PowerEdge FC640
PowerEdge C6420
PowerEdge T640
PowerEdge R940XA
PowerEdge R840
PowerEdge R740XD2
PowerEdge XR2
PowerEdge R440
PowerEdge R540
PowerEdge R940
PowerEdge R640
PowerEdge R740XD
PowerEdge R740
PowerFlex Appliance
PowerFlex rack

Install updates from vendor's website.

PowerFlex Appliance - update to IC 38.363.02
PowerEdge T150 - update to 1.5.0
PowerEdge R250 - update to 1.5.0
PowerEdge T350 - update to 1.5.0
PowerEdge R350 - update to 1.5.0
PowerEdge R750XA - update to 1.9.2
PowerEdge R750 - update to 1.9.2
PowerEdge XR12 - update to 1.9.2
PowerEdge XR11 - update to 1.9.2
PowerEdge R650XS - update to 1.9.2
PowerEdge R450 - update to 1.9.2
PowerEdge T550 - update to 1.9.2
PowerEdge R550 - update to 1.9.2
PowerEdge MX750c - update to 1.9.2
PowerEdge C6520 - update to 1.9.2
PowerEdge R650 - update to 1.9.2
PowerEdge R750XS - update to 1.9.2
PowerEdge T340 - update to 2.12.2
PowerEdge T140 - update to 2.12.2
PowerEdge R240 - update to 2.12.2
PowerEdge R340 - update to 2.12.2
PowerEdge XE7440 - update to 2.17.1
PowerEdge T440 - update to 2.17.1
PowerEdge XE7420 - update to 2.17.1
PowerEdge XE2420 - update to 2.17.1
PowerEdge DSS8440 - update to 2.17.1
PowerEdge C4140 - update to 2.17.1
PowerEdge MX840C - update to 2.17.1
PowerEdge MX740C - update to 2.17.1
PowerEdge M640P - update to 2.17.1
PowerEdge M640 - update to 2.17.1
PowerEdge FC640 - update to 2.17.1
PowerEdge C6420 - update to 2.17.1
PowerEdge T640 - update to 2.17.1
PowerEdge R940XA - update to 2.17.1
PowerEdge R840 - update to 2.17.1
PowerEdge R740XD2 - update to 2.17.1
PowerEdge XR2 - update to 2.17.1
PowerEdge R440 - update to 2.17.1
PowerEdge R540 - update to 2.17.1
PowerEdge R940 - update to 2.17.1
PowerEdge R640 - update to 2.17.1
PowerEdge R740XD - update to 2.17.1
PowerEdge R740 - update to 2.17.1
PowerFlex rack - update to 3.6.3.2

• http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00717.html

• Multiple vulnerabilities in Intel BIOS firmware for Intel processors
• Multiple vulnerabilities in Dell PowerEdge Server firmware
• Multiple vulnerabilities in Dell PowerFlex Appliance
• Multiple vulnerabilities in Dell PowerFlex Rack