Exposed dangerous method or function in Intel Server Platform Services Firmware - CVE-2022-36348

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU72464

Exposed dangerous method or function in Intel Server Platform Services Firmware - CVE-2022-36348

Published: February 21, 2023


Vulnerability identifier: #VU72464
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-36348
CWE-ID: CWE-749
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to usage of active debug code. A local user can execute arbitrary code with elevated privileges.


Affected software

Intel Server Platform Services Firmware
PowerFlex Appliance
PowerFlex rack
HPE StoreEasy 1860 Performance Storage
HPE StoreEasy 1660 Storage
PowerEdge T150
PowerEdge R250
PowerEdge T350
PowerEdge R350
PowerEdge R750
PowerEdge XR12
PowerEdge XR11
PowerEdge R650XS
PowerEdge R450
PowerEdge T550
PowerEdge R550
PowerEdge MX750c
PowerEdge C6520
PowerEdge R650
PowerEdge R750XA
PowerEdge R750XS
PowerEdge R240
PowerEdge T140
PowerEdge T340
PowerEdge R340
PowerEdge XE7440
PowerEdge XE7420
PowerEdge XE2420
PowerEdge DSS8440
PowerEdge C4140
PowerEdge MX840C
PowerEdge MX740C
PowerEdge M640P
PowerEdge FC640
PowerEdge R740
PowerEdge R740XD
PowerEdge R640
PowerEdge R940
PowerEdge R540
PowerEdge R440
PowerEdge T440
PowerEdge R740XD2
PowerEdge R840
PowerEdge R940XA
PowerEdge XR2
PowerEdge M640
PowerEdge C6420
PowerEdge T640
HPE ProLiant DX360 Gen10 Plus server
HPE ProLiant DL110 Gen10 Plus Telco server
HPE ProLiant DL380 Gen10 Plus server
HPE ProLiant DL360 Gen10 Plus server
HPE Apollo 4200 Gen10 Plus System
HPE ProLiant XL290n Gen10 Plus Server
HPE ProLiant XL220n Gen10 Plus Server
HPE Apollo 2000 Gen10 Plus System
HPE Edgeline e920t Server Blade
HPE Edgeline e920d Server Blade
HPE Edgeline e920 Server Blade
HPE ProLiant DX380 Gen10 Plus server
HPE Synergy 480 Gen10 Compute Module
HPE ProLiant MicroServer Gen10 Plus
HPE ProLiant DL20 Gen10 Plus server
HPE ProLiant ML30 Gen10 Plus server

How to mitigate CVE-2022-36348

Install updates from vendor's website.

Intel Server Platform Services Firmware - addressed in versions SPS_E3_06.00.03.300.0, SPS_E5_04.04.04.300.0
PowerFlex Appliance - update to IC 38.363.02
HPE StoreEasy 1860 Performance Storage - update to SPS_E5_04.04.04.300.0
HPE StoreEasy 1660 Storage - update to SPS_E5_04.04.04.300.0
PowerEdge T150 - update to 1.5.0
PowerEdge R250 - update to 1.5.0
PowerEdge T350 - update to 1.5.0
PowerEdge R350 - update to 1.5.0
PowerEdge R750 - update to 1.9.2
PowerEdge XR12 - update to 1.9.2
PowerEdge XR11 - update to 1.9.2
PowerEdge R650XS - update to 1.9.2
PowerEdge R450 - update to 1.9.2
PowerEdge T550 - update to 1.9.2
PowerEdge R550 - update to 1.9.2
PowerEdge MX750c - update to 1.9.2
PowerEdge C6520 - update to 1.9.2
PowerEdge R650 - update to 1.9.2
PowerEdge R750XA - update to 1.9.2
PowerEdge R750XS - update to 1.9.2
PowerEdge R240 - update to 2.12.2
PowerEdge T140 - update to 2.12.2
PowerEdge T340 - update to 2.12.2
PowerEdge R340 - update to 2.12.2
PowerEdge XE7440 - update to 2.17.1
PowerEdge XE7420 - update to 2.17.1
PowerEdge XE2420 - update to 2.17.1
PowerEdge DSS8440 - update to 2.17.1
PowerEdge C4140 - update to 2.17.1
PowerEdge MX840C - update to 2.17.1
PowerEdge MX740C - update to 2.17.1
PowerEdge M640P - update to 2.17.1
PowerEdge FC640 - update to 2.17.1
PowerEdge R740 - update to 2.17.1
PowerEdge R740XD - update to 2.17.1
PowerEdge R640 - update to 2.17.1
PowerEdge R940 - update to 2.17.1
PowerEdge R540 - update to 2.17.1
PowerEdge R440 - update to 2.17.1
PowerEdge T440 - update to 2.17.1
PowerEdge R740XD2 - update to 2.17.1
PowerEdge R840 - update to 2.17.1
PowerEdge R940XA - update to 2.17.1
PowerEdge XR2 - update to 2.17.1
PowerEdge M640 - update to 2.17.1
PowerEdge C6420 - update to 2.17.1
PowerEdge T640 - update to 2.17.1
PowerFlex rack - update to 3.6.3.2
HPE ProLiant DX360 Gen10 Plus server - update to 04.04.04.300
HPE ProLiant DL110 Gen10 Plus Telco server - update to 04.04.04.300
HPE ProLiant DL380 Gen10 Plus server - update to 04.04.04.300
HPE ProLiant DL360 Gen10 Plus server - update to 04.04.04.300
HPE Apollo 4200 Gen10 Plus System - update to 04.04.04.300
HPE ProLiant XL290n Gen10 Plus Server - update to 04.04.04.300
HPE ProLiant XL220n Gen10 Plus Server - update to 04.04.04.300
HPE Apollo 2000 Gen10 Plus System - update to 04.04.04.300
HPE Edgeline e920t Server Blade - update to 04.04.04.300
HPE Edgeline e920d Server Blade - update to 04.04.04.300
HPE Edgeline e920 Server Blade - update to 04.04.04.300
HPE ProLiant DX380 Gen10 Plus server - update to 04.04.04.300
HPE Synergy 480 Gen10 Compute Module - update to 04.04.04.300
HPE ProLiant MicroServer Gen10 Plus - update to 06.00.03.309
HPE ProLiant DL20 Gen10 Plus server - update to 06.00.03.309
HPE ProLiant ML30 Gen10 Plus server - update to 06.00.03.309

External References

Related Security Bulletins