Improper handling of exceptional conditions in Intel Server Platform Services Firmware - CVE-2022-36794

Vulnerability identifier: #VU72465

CSH Severity: Low

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-36794

CWE-ID: CWE-755

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper handling of errors. A local user can perform a denial of service (DoS) attack.

Intel Server Platform Services Firmware
PowerFlex Appliance
PowerFlex rack
PowerEdge T150
PowerEdge R250
PowerEdge T350
PowerEdge R350
PowerEdge R750XA
PowerEdge R750
PowerEdge XR12
PowerEdge XR11
PowerEdge R650XS
PowerEdge R450
PowerEdge T550
PowerEdge R550
PowerEdge MX750c
PowerEdge C6520
PowerEdge R650
PowerEdge R750XS
PowerEdge T340
PowerEdge T140
PowerEdge R240
PowerEdge R340
PowerEdge XE7440
PowerEdge XE7420
PowerEdge XE2420
PowerEdge DSS8440
PowerEdge R840
PowerEdge C4140
PowerEdge MX840C
PowerEdge MX740C
PowerEdge M640P
PowerEdge FC640
PowerEdge R740
PowerEdge R740XD
PowerEdge R640
PowerEdge R940
PowerEdge R540
PowerEdge R440
PowerEdge T440
PowerEdge XR2
PowerEdge R740XD2
PowerEdge R940XA
PowerEdge T640
PowerEdge C6420
PowerEdge M640
HPE ProLiant DL110 Gen10 Plus Telco server
HPE ProLiant DL380 Gen10 Plus server
HPE ProLiant DL360 Gen10 Plus server
HPE ProLiant MicroServer Gen10 Plus
HPE ProLiant DL20 Gen10 Plus server
HPE ProLiant ML30 Gen10 Plus server

Install updates from vendor's website.

Intel Server Platform Services Firmware - addressed in versions SPS_E3_06.00.03.300.0, SPS_E5_04.04.04.300.0
PowerFlex Appliance - update to IC 38.363.02
PowerEdge T150 - update to 1.5.0
PowerEdge R250 - update to 1.5.0
PowerEdge T350 - update to 1.5.0
PowerEdge R350 - update to 1.5.0
PowerEdge R750XA - update to 1.9.2
PowerEdge R750 - update to 1.9.2
PowerEdge XR12 - update to 1.9.2
PowerEdge XR11 - update to 1.9.2
PowerEdge R650XS - update to 1.9.2
PowerEdge R450 - update to 1.9.2
PowerEdge T550 - update to 1.9.2
PowerEdge R550 - update to 1.9.2
PowerEdge MX750c - update to 1.9.2
PowerEdge C6520 - update to 1.9.2
PowerEdge R650 - update to 1.9.2
PowerEdge R750XS - update to 1.9.2
PowerEdge T340 - update to 2.12.2
PowerEdge T140 - update to 2.12.2
PowerEdge R240 - update to 2.12.2
PowerEdge R340 - update to 2.12.2
PowerEdge XE7440 - update to 2.17.1
PowerEdge XE7420 - update to 2.17.1
PowerEdge XE2420 - update to 2.17.1
PowerEdge DSS8440 - update to 2.17.1
PowerEdge R840 - update to 2.17.1
PowerEdge C4140 - update to 2.17.1
PowerEdge MX840C - update to 2.17.1
PowerEdge MX740C - update to 2.17.1
PowerEdge M640P - update to 2.17.1
PowerEdge FC640 - update to 2.17.1
PowerEdge R740 - update to 2.17.1
PowerEdge R740XD - update to 2.17.1
PowerEdge R640 - update to 2.17.1
PowerEdge R940 - update to 2.17.1
PowerEdge R540 - update to 2.17.1
PowerEdge R440 - update to 2.17.1
PowerEdge T440 - update to 2.17.1
PowerEdge XR2 - update to 2.17.1
PowerEdge R740XD2 - update to 2.17.1
PowerEdge R940XA - update to 2.17.1
PowerEdge T640 - update to 2.17.1
PowerEdge C6420 - update to 2.17.1
PowerEdge M640 - update to 2.17.1
PowerFlex rack - update to 3.6.3.2
HPE ProLiant DL110 Gen10 Plus Telco server - update to 04.04.04.300
HPE ProLiant DL380 Gen10 Plus server - update to 04.04.04.300
HPE ProLiant DL360 Gen10 Plus server - update to 04.04.04.300
HPE ProLiant MicroServer Gen10 Plus - update to 06.00.03.309
HPE ProLiant DL20 Gen10 Plus server - update to 06.00.03.309
HPE ProLiant ML30 Gen10 Plus server - update to 06.00.03.309

• http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00718.html

• Multiple vulnerabilities in Intel Server Platform Services (SPS) firmware
• Multiple vulnerabilities in Dell PowerEdge Server firmware
• Multiple vulnerabilities in Certain HPE ProLiant DL/ML/Microserver Servers
• Multiple vulnerabilities in Dell PowerFlex Appliance
• Multiple vulnerabilities in Dell PowerFlex Rack