Exposure of resource to wrong sphere in Intel products - CVE-2022-38087

Vulnerability identifier: #VU75931

CSH Severity: Low

CVSS v4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-38087

CWE-ID: CWE-668

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to exposure of resource to wrong sphere in BIOS firmware. A local user can gain access to sensitive information.

8th Generation Intel Core Processors
10th Generation Intel Core Processors
7th Generation Intel Core Processors
Intel Xeon Processor E Family
Intel Xeon Platinum P-8124 processors
Intel Xeon Platinum P-8136 processors
Intel Xeon D Processors
Intel Xeon W Processors
PowerEdge T40
HPE ProLiant m750 Server Blade
HPE ProLiant e910t Server Blade
HPE ProLiant e910 Server Blade
Precision 7920 Rack
HPE ProLiant ML30 Gen10 Server
HPE ProLiant DL20 Gen10 Server
HPE ProLiant MicroServer Gen10 Plus
HPE Storage File Controller
HPE ProLiant DL160 Gen10 Server
HPE ProLiant DL180 Gen10 Server
HPE ProLiant DL360 Gen10 Server
HPE StoreEasy 1860 Performance Storage
HPE Storage Performance File Controller
HPE StoreEasy 1660 Expanded Storage
HPE StoreEasy 1460 Storage
HPE Synergy 660 Gen10 Compute Module
HPE ProLiant BL460c Gen10 Server Blade
HPE ProLiant DX170r Gen10 server
HPE ProLiant DX190r Gen10 server
HPE ProLiant DX360 Gen10 server
HPE ProLiant DX380 Gen10 server
HPE ProLiant DX560 Gen10 server
HPE ProLiant DX4200 Gen10 server
HPE Apollo 2000 System ROM
HPE Apollo 4200 Gen10 Server
HPE Apollo 4510 Gen10 System
HPE Apollo 6500 Gen10 System
HPE ProLiant XL170r Gen10 Server
HPE ProLiant XL190r Gen10 Server
HPE ProLiant XL230k Gen10 Server
HPE ProLiant XL270d Gen10 Server
HPE ProLiant XL450 Gen10 Server
HPE Synergy 480 Gen10 Compute Module
HPE ProLiant ML30 Gen9 Server
HPE ProLiant DL20 Gen9 Server
Superdome Flex Server
HPE SimpliVity 380 Gen10
HPE SimpliVity 380 Gen10 G
HPE SimpliVity 380 Gen10 H
HPE SimpliVity 190r Gen10 Server
HPE SimpliVity 170r Gen10 Server
Intel Xeon Scalable Processors
F5OS
Edge Gateway 5200
Networking VEP4600
PowerEdge T30 Mini Tower Server

Install updates from vendor's website.

Edge Gateway 5200 - addressed in versions 1.09.10, 2.00.10
PowerEdge T40 - update to 1.11.0
PowerEdge T30 Mini Tower Server - update to 1.11.0
HPE ProLiant m750 Server Blade - update to 1.58_04-20-2023
HPE ProLiant e910t Server Blade - update to 2.06_04-20-2023
HPE ProLiant e910 Server Blade - update to 2.06_04-20-2023
Precision 7920 Rack - update to 2.18.1
HPE ProLiant ML30 Gen10 Server - update to 2.72_04-20-2023
HPE ProLiant DL20 Gen10 Server - update to 2.72_04-20-2023
HPE ProLiant MicroServer Gen10 Plus - update to 2.72_04-20-2023
HPE Storage File Controller - update to 2.80_04-20-2023
HPE ProLiant DL160 Gen10 Server - update to 2.80_04-20-2023
HPE ProLiant DL180 Gen10 Server - update to 2.80_04-20-2023
HPE ProLiant DL360 Gen10 Server - update to 2.80_04-20-2023
HPE StoreEasy 1860 Performance Storage - update to 2.80_04-20-2023
HPE Storage Performance File Controller - update to 2.80_04-20-2023
HPE StoreEasy 1660 Expanded Storage - update to 2.80_04-20-2023
HPE StoreEasy 1460 Storage - update to 2.80_04-20-2023
HPE Synergy 660 Gen10 Compute Module - update to 2.80_04-20-2023
HPE ProLiant BL460c Gen10 Server Blade - update to 2.80_04-20-2023
HPE ProLiant DX170r Gen10 server - update to 2.80_04-20-2023
HPE ProLiant DX190r Gen10 server - update to 2.80_04-20-2023
HPE ProLiant DX360 Gen10 server - update to 2.80_04-20-2023
HPE ProLiant DX380 Gen10 server - update to 2.80_04-20-2023
HPE ProLiant DX560 Gen10 server - update to 2.80_04-20-2023
HPE ProLiant DX4200 Gen10 server - update to 2.80_04-20-2023
HPE Apollo 2000 System ROM - update to 2.80_04-20-2023
HPE Apollo 4200 Gen10 Server - update to 2.80_04-20-2023
HPE Apollo 4510 Gen10 System - update to 2.80_04-20-2023
HPE Apollo 6500 Gen10 System - update to 2.80_04-20-2023
HPE ProLiant XL170r Gen10 Server - update to 2.80_04-20-2023
HPE ProLiant XL190r Gen10 Server - update to 2.80_04-20-2023
HPE ProLiant XL230k Gen10 Server - update to 2.80_04-20-2023
HPE ProLiant XL270d Gen10 Server - update to 2.80_04-20-2023
HPE ProLiant XL450 Gen10 Server - update to 2.80_04-20-2023
HPE Synergy 480 Gen10 Compute Module - update to 2.80_04-20-2023
HPE ProLiant ML30 Gen9 Server - update to 3.14_03-09-2023
HPE ProLiant DL20 Gen9 Server - update to 3.14_03-09-2023
Superdome Flex Server - update to 3.60.50
Networking VEP4600 - update to 4.3
HPE SimpliVity 380 Gen10 - update to 2023_0803
HPE SimpliVity 380 Gen10 G - update to 2023_0803
HPE SimpliVity 380 Gen10 H - update to 2023_0803
HPE SimpliVity 190r Gen10 Server - update to 2023_0803
HPE SimpliVity 170r Gen10 Server - update to 2023_0803

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00807.html

• Multiple vulnerabilities in Intel BIOS firmware
• Multiple vulnerabilities in Dell PowerEdge T30/T40 Mini Tower Server
• Dell Precision 7920 Rack update for BIOS
• HPE Proliant DX Servers update for BIOS
• HPE Apollo and XL Servers update for BIOS
• HPE Synergy Servers update for BIOS
• HPE StoreEasy Servers update for BIOS
• HPE Superdome Flex Servers update for BIOS
• HPE ProLiant DL/ML Servers update for BIOS
• Information disclosure in F5OS BIOS
• Multiple vulnerabilities in Certain HPE Edgeline Servers Using Certain Intel Processors
• Multiple vulnerabilities in Dell Networking VEP4600 and Dell Edge Gateway 5200
• Multiple vulnerabilities in Certain HPE SimpliVity Servers