Input validation error in Intel products - CVE-2022-26837

Vulnerability identifier: #VU72452

CSH Severity: Low

CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-26837

CWE-ID: CWE-20

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insufficient validation of user-supplied input in the BIOS firmware. A local user can execute arbitrary code with elevated privileges.

3rd Generation Intel Xeon Scalable Processors
Intel Xeon E Processors
11th Generation Intel Core Processors
Intel Xeon W Processors
HPE StoreEasy 1860 Storage
HPE StoreEasy 1660 Storage
PowerEdge T150
PowerEdge R250
PowerEdge T350
PowerEdge R350
PowerEdge R750XA
PowerEdge R750
PowerEdge XR12
PowerEdge XR11
PowerEdge R750XS
PowerEdge R650XS
PowerEdge R450
PowerEdge T550
PowerEdge R550
PowerEdge MX750c
PowerEdge C6520
PowerEdge R650
PowerEdge T40
Superdome Flex 280 Server
HPE ProLiant m750 Server Blade
HPE Edgeline e920t Server Blade
HPE Edgeline e920 Server Blade
HPE Edgeline e920d Server Blade
HPE ProLiant ML30 Gen10 Plus server
HPE ProLiant MicroServer Gen10 Plus
HPE ProLiant DL20 Gen10 Plus server
HPE ProLiant DX380 Gen10 Plus server
HPE Apollo 4200 Gen10 Plus System
HPE ProLiant DX360 Gen10 Plus server
HPE ProLiant XL220n Gen10 Plus Server
HPE ProLiant XL290n Gen10 Plus Server
HPE ProLiant DL380 Gen10 Plus server
HPE ProLiant DL360 Gen10 Plus server
HPE ProLiant DL110 Gen10 Plus Telco server
HPE ProLiant m710x Server Blade
HPE ProLiant m710x-L Server Blade
HPE ProLiant e910 Server Blade
HPE ProLiant e910t Server Blade
PowerEdge T140
PowerEdge T340
PowerEdge R240
PowerEdge R340
PowerEdge R940
PowerEdge R640
PowerEdge R540
PowerEdge R740XD
PowerEdge R740
PowerEdge R740XD2
PowerEdge R440
PowerEdge XR2
PowerEdge R840
PowerEdge R940XA
PowerEdge T640
PowerEdge C6420
PowerEdge FC640
PowerEdge M640
PowerEdge M640P
PowerEdge MX740C
PowerEdge MX840C
PowerEdge C4140
PowerEdge DSS8440
PowerEdge XE7420
PowerEdge XE2420
PowerEdge T440
PowerEdge XE7440
HPE ProLiant DL20 Gen10 Server
HPE ProLiant ML30 Gen10 Server
HPE ProLiant DX560 Gen10 server
HPE Apollo 2000 Gen10 Plus System
HPE ProLiant XL450 Gen10 Server
HPE Apollo 2000 System ROM
HPE Apollo 4200 Gen10 Server
HPE Apollo 4510 Gen10 System
HPE ProLiant XL70d Gen10 Server
HPE ProLiant XL230k Gen10 Server
HPE Apollo 6500 Gen10 System
HPE ProLiant XL190r Gen10 Server
HPE ProLiant XL170r Gen10 Server
HPE ProLiant DL160 Gen10 Server
HPE Synergy 480 Gen10 Compute Module
HPE Synergy 660 Gen10 Compute Module
HPE ProLiant BL460c Gen10 Server Blade
HPE ProLiant DX380 Gen10 server
HPE ProLiant DX360 Gen10 server
HPE Storage Performance File Controller
HPE Storage File Controller
HPE StoreEasy 1860 Performance Storage
HPE StoreEasy 1660 Performance Storage
HPE StoreEasy 1660 Expanded Storage
HPE StoreEasy 1560 Storage
HPE StoreEasy 1460 Storage
HPE ProLiant ML350 Gen10 Server
HPE ProLiant ML110 Gen10 Server
HPE ProLiant DL560 Gen10 Server
HPE ProLiant DL380 Gen10 Server
HPE ProLiant DL360 Gen10 Server
HPE ProLiant DL180 Gen10 Server
PowerFlex Appliance
HPE Synergy 480 Gen10 Plus Compute Module
PowerFlex rack

Install updates from vendor's website.

PowerFlex Appliance - update to IC 38.363.02
PowerEdge T150 - update to 1.5.0
PowerEdge R250 - update to 1.5.0
PowerEdge T350 - update to 1.5.0
PowerEdge R350 - update to 1.5.0
PowerEdge R750XA - update to 1.9.2
PowerEdge R750 - update to 1.9.2
PowerEdge XR12 - update to 1.9.2
PowerEdge XR11 - update to 1.9.2
PowerEdge R750XS - update to 1.9.2
PowerEdge R650XS - update to 1.9.2
PowerEdge R450 - update to 1.9.2
PowerEdge T550 - update to 1.9.2
PowerEdge R550 - update to 1.9.2
PowerEdge MX750c - update to 1.9.2
PowerEdge C6520 - update to 1.9.2
PowerEdge R650 - update to 1.9.2
PowerEdge T40 - update to 1.10.0
Superdome Flex 280 Server - update to 1.40.60
HPE ProLiant m750 Server Blade - update to 1.56_02-02-2023
HPE Edgeline e920t Server Blade - update to 1.66_02-02-2023
HPE Edgeline e920 Server Blade - update to 1.66_02-02-2023
HPE Edgeline e920d Server Blade - update to 1.66_02-02-2023
HPE ProLiant ML30 Gen10 Plus server - update to 1.68_01-12-2023
HPE ProLiant MicroServer Gen10 Plus - update to 1.68_01-12-2023
HPE ProLiant DL20 Gen10 Plus server - update to 1.68_01-12-2023
HPE ProLiant DX380 Gen10 Plus server - update to 1.72_02-02-2023
HPE Apollo 4200 Gen10 Plus System - update to 1.72_02-02-2023
HPE ProLiant DX360 Gen10 Plus server - update to 1.72_02-02-2023
HPE Synergy 480 Gen10 Plus Compute Module - update to 1.72_02-02-2023
HPE ProLiant XL220n Gen10 Plus Server - update to 1.72_02-02-2023
HPE ProLiant XL290n Gen10 Plus Server - update to 1.72_02-02-2023
HPE ProLiant DL380 Gen10 Plus server - update to 1.72_02-02-2023
HPE ProLiant DL360 Gen10 Plus server - update to 1.72_02-02-2023
HPE ProLiant DL110 Gen10 Plus Telco server - update to 1.72_02-02-2023
HPE ProLiant m710x Server Blade - update to 1.98_02-02-2023
HPE ProLiant m710x-L Server Blade - update to 1.98_02-02-2023
HPE ProLiant e910 Server Blade - update to 2.02_02-09-2023
HPE ProLiant e910t Server Blade - update to 2.02_02-09-2023
PowerEdge T140 - update to 2.12.2
PowerEdge T340 - update to 2.12.2
PowerEdge R240 - update to 2.12.2
PowerEdge R340 - update to 2.12.2
PowerEdge R940 - update to 2.17.1
PowerEdge R640 - update to 2.17.1
PowerEdge R540 - update to 2.17.1
PowerEdge R740XD - update to 2.17.1
PowerEdge R740 - update to 2.17.1
PowerEdge R740XD2 - update to 2.17.1
PowerEdge R440 - update to 2.17.1
PowerEdge XR2 - update to 2.17.1
PowerEdge R840 - update to 2.17.1
PowerEdge R940XA - update to 2.17.1
PowerEdge T640 - update to 2.17.1
PowerEdge C6420 - update to 2.17.1
PowerEdge FC640 - update to 2.17.1
PowerEdge M640 - update to 2.17.1
PowerEdge M640P - update to 2.17.1
PowerEdge MX740C - update to 2.17.1
PowerEdge MX840C - update to 2.17.1
PowerEdge C4140 - update to 2.17.1
PowerEdge DSS8440 - update to 2.17.1
PowerEdge XE7420 - update to 2.17.1
PowerEdge XE2420 - update to 2.17.1
PowerEdge T440 - update to 2.17.1
PowerEdge XE7440 - update to 2.17.1
HPE ProLiant DL20 Gen10 Server - update to 2.68_01-12-2023
HPE ProLiant ML30 Gen10 Server - update to 2.68_01-12-2023
HPE ProLiant DX560 Gen10 server - update to 2.76_02-09-2023
HPE Apollo 2000 Gen10 Plus System - update to 2.76_02-09-2023
HPE ProLiant XL450 Gen10 Server - update to 2.76_02-09-2023
HPE Apollo 2000 System ROM - update to 2.76_02-09-2023
HPE Apollo 4200 Gen10 Server - update to 2.76_02-09-2023
HPE Apollo 4510 Gen10 System - update to 2.76_02-09-2023
HPE ProLiant XL70d Gen10 Server - update to 2.76_02-09-2023
HPE ProLiant XL230k Gen10 Server - update to 2.76_02-09-2023
HPE Apollo 6500 Gen10 System - update to 2.76_02-09-2023
HPE ProLiant XL190r Gen10 Server - update to 2.76_02-09-2023
HPE ProLiant XL170r Gen10 Server - update to 2.76_02-09-2023
HPE ProLiant DL160 Gen10 Server - update to 2.76_02-09-2023
HPE Synergy 480 Gen10 Compute Module - update to 2.76_02-09-2023
HPE Synergy 660 Gen10 Compute Module - update to 2.76_02-09-2023
HPE ProLiant BL460c Gen10 Server Blade - update to 2.76_02-09-2023
HPE ProLiant DX380 Gen10 server - update to 2.76_02-09-2023
HPE ProLiant DX360 Gen10 server - update to 2.76_02-09-2023
HPE Storage Performance File Controller - update to 2.76_02-09-2023
HPE Storage File Controller - update to 2.76_02-09-2023
HPE StoreEasy 1860 Performance Storage - update to 2.76_02-09-2023
HPE StoreEasy 1660 Performance Storage - update to 2.76_02-09-2023
HPE StoreEasy 1660 Expanded Storage - update to 2.76_02-09-2023
HPE StoreEasy 1560 Storage - update to 2.76_02-09-2023
HPE StoreEasy 1460 Storage - update to 2.76_02-09-2023
HPE ProLiant ML350 Gen10 Server - update to 2.76_02-09-2023
HPE ProLiant ML110 Gen10 Server - update to 2.76_02-09-2023
HPE ProLiant DL560 Gen10 Server - update to 2.76_02-09-2023
HPE ProLiant DL380 Gen10 Server - update to 2.76_02-09-2023
HPE ProLiant DL360 Gen10 Server - update to 2.76_02-09-2023
HPE ProLiant DL180 Gen10 Server - update to 2.76_02-09-2023
PowerFlex rack - update to 3.6.3.2

• http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00717.html

• Multiple vulnerabilities in Intel BIOS firmware for Intel processors
• Multiple vulnerabilities in Dell PowerEdge Server firmware
• Privilege escalation in Dell PowerEdge T40
• Multiple vulnerabilities in Certain HPE Synergy Servers
• Multiple vulnerabilities in Certain HPE Proliant DX Servers
• Multiple vulnerabilities in Certain HPE ProLiant BL/DL/ML Servers
• Input validation error in Certain HPE Superdome Flex 280 Servers
• Multiple vulnerabilities in Certain HPE ProLiant BL/DL/ML Servers
• Multiple vulnerabilities in Certain HPE Moonshot/Edgeline Servers
• Multiple vulnerabilities in Certain HPE Apollo, XL Servers
• Multiple vulnerabilities in Dell PowerFlex Appliance
• Multiple vulnerabilities in Dell PowerFlex Rack