Input validation error in Intel products - CVE-2022-33894

Vulnerability identifier: #VU75930

CSH Severity: Low

CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-33894

CWE-ID: CWE-20

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insufficient input validation in the BIOS firmware. A local user can execute arbitrary code with escalated privileges.

8th Generation Intel Core Processors
Intel Xeon Processor E Family
7th Generation Intel Core Processors
10th Generation Intel Core Processors
PowerEdge T40
HPE ProLiant m750 Server Blade
HPE ProLiant e910 Server Blade
HPE ProLiant e910t Server Blade
HPE ProLiant ML30 Gen10 Server
HPE ProLiant DL20 Gen10 Server
HPE ProLiant MicroServer Gen10 Plus
HPE ProLiant DL160 Gen10 Server
HPE ProLiant DL180 Gen10 Server
HPE ProLiant DL360 Gen10 Server
HPE ProLiant ML30 Gen9 Server
HPE ProLiant DL20 Gen9 Server
HPE SimpliVity 380 Gen10
HPE SimpliVity 380 Gen10 G
HPE SimpliVity 380 Gen10 H
HPE SimpliVity 190r Gen10 Server
HPE SimpliVity 170r Gen10 Server
9th Generation Intel Core Processors
Edge Gateway 5200
Networking VEP4600
PowerEdge T30 Mini Tower Server

Install updates from vendor's website.

Edge Gateway 5200 - addressed in versions 1.09.10, 2.00.10
PowerEdge T40 - update to 1.11.0
PowerEdge T30 Mini Tower Server - update to 1.11.0
HPE ProLiant m750 Server Blade - update to 1.58_04-20-2023
HPE ProLiant e910 Server Blade - update to 2.06_04-20-2023
HPE ProLiant e910t Server Blade - update to 2.06_04-20-2023
HPE ProLiant ML30 Gen10 Server - update to 2.72_04-20-2023
HPE ProLiant DL20 Gen10 Server - update to 2.72_04-20-2023
HPE ProLiant MicroServer Gen10 Plus - update to 2.72_04-20-2023
HPE ProLiant DL160 Gen10 Server - update to 2.80_04-20-2023
HPE ProLiant DL180 Gen10 Server - update to 2.80_04-20-2023
HPE ProLiant DL360 Gen10 Server - update to 2.80_04-20-2023
HPE ProLiant ML30 Gen9 Server - update to 3.14_03-09-2023
HPE ProLiant DL20 Gen9 Server - update to 3.14_03-09-2023
Networking VEP4600 - update to 4.3
HPE SimpliVity 380 Gen10 - update to 2023_0803
HPE SimpliVity 380 Gen10 G - update to 2023_0803
HPE SimpliVity 380 Gen10 H - update to 2023_0803
HPE SimpliVity 190r Gen10 Server - update to 2023_0803
HPE SimpliVity 170r Gen10 Server - update to 2023_0803

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00807.html

• Multiple vulnerabilities in Intel BIOS firmware
• Multiple vulnerabilities in Dell PowerEdge T30/T40 Mini Tower Server
• HPE ProLiant DL/ML Servers update for BIOS
• Multiple vulnerabilities in Certain HPE Edgeline Servers Using Certain Intel Processors
• Multiple vulnerabilities in Dell Networking VEP4600 and Dell Edge Gateway 5200
• Multiple vulnerabilities in Certain HPE SimpliVity Servers