Unauthorized error injection in Intel products - CVE-2022-41804

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU79378

Unauthorized error injection in Intel products - CVE-2022-41804

Published: August 11, 2023


Vulnerability identifier: #VU79378
CSH Severity: Low
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-41804
CWE-ID: CWE-1334
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to unauthorized error injection in some Intel Xeon Processors with Intel Software Guard Extensions (SGX). A local user can execute arbitrary code with elevated privileges.


Affected software

3rd Generation Intel Xeon Scalable Processors
Intel Xeon D Processors
4th Generation Intel Xeon Scalable Processors
HPE Edgeline e920t Server Blade
HPE Edgeline e920 Server Blade
HPE Edgeline e920d Server Blade
HPE ProLiant DL380 Gen10 Plus server
HPE Apollo 4200 Gen10 Plus System
HPE ProLiant XL290n Gen10 Plus Server
HPE ProLiant XL220n Gen10 Plus Server
HPE Apollo 2000 Gen10 Plus System
HPE StoreEasy 1660 Storage
HPE StoreEasy 1860 Storage
HPE ProLiant DL360 Gen10 Plus server
HPE ProLiant DL110 Gen10 Plus Telco server
HPE ProLiant DX380 Gen10 Plus server
HPE ProLiant DX360 Gen10 Plus server
HPE ProLiant DX220n Gen10 Plus server
Precision 7920 Rack
Precision 7920 XL Rack
Precision 7960 XL Rack
HPE SimpliVity 380 Gen10 Plus
VMware Tanzu Application Service for VMs
Isolation Segment
Debian Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
SUSE Enterprise Storage
SUSE Linux Enterprise Server 12 SP2 BCL
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Basesystem Module
openSUSE Leap
Ubuntu
Fedora
intel-microcode (Ubuntu package)
microcode_ctl
intel-microcode (Debian package)
ucode-intel-debuginfo
ucode-intel-debugsource
ucode-intel
HPE Synergy 480 Gen10 Plus Compute Module
Precision 7960 Rack
PowerSwitch Z9664F-ON
SimpliVity Omnistack
VMware Tanzu Operations Manager
RecoverPoint for VMs

How to mitigate CVE-2022-41804

Install updates from vendor's website.

intel-microcode (Ubuntu package) - addressed in versions Ubuntu Pro, 3.20230808.0ubuntu0.20.04.1, 3.20230808.0ubuntu0.22.04.1, 3.20230808.0ubuntu1
HPE Edgeline e920t Server Blade - update to 1.74_07-24-2023
HPE Edgeline e920 Server Blade - update to 1.74_07-24-2023
HPE Edgeline e920d Server Blade - update to 1.74_07-24-2023
HPE ProLiant DL380 Gen10 Plus server - update to 1.80_07-05-2023
HPE Apollo 4200 Gen10 Plus System - update to 1.80_07-05-2023
HPE ProLiant XL290n Gen10 Plus Server - update to 1.80_07-05-2023
HPE ProLiant XL220n Gen10 Plus Server - update to 1.80_07-05-2023
HPE Apollo 2000 Gen10 Plus System - update to 1.80_07-05-2023
HPE StoreEasy 1660 Storage - update to 1.80_07-05-2023
HPE StoreEasy 1860 Storage - update to 1.80_07-05-2023
HPE ProLiant DL360 Gen10 Plus server - update to 1.80_07-05-2023
HPE ProLiant DL110 Gen10 Plus Telco server - update to 1.80_07-05-2023
HPE Synergy 480 Gen10 Plus Compute Module - update to 1.80_07-05-2023
HPE ProLiant DX380 Gen10 Plus server - update to 1.80_07-05-2023
HPE ProLiant DX360 Gen10 Plus server - update to 1.80_07-05-2023
HPE ProLiant DX220n Gen10 Plus server - update to 1.80_07-05-2023
microcode_ctl - addressed in versions 2.1-53.2.fc37, 2.1-55.1.fc38
VMware Tanzu Operations Manager - addressed in versions 2.10.61, 3.0.15
Precision 7920 Rack - update to 2.19.1
Precision 7920 XL Rack - update to 2.19.1
Precision 7960 Rack - update to 2.19.1
Precision 7960 XL Rack - update to 2.19.1
PowerSwitch Z9664F-ON - update to 3.54.5.1-6
intel-microcode (Debian package) - addressed in versions 3.20230808.1~deb11u1, 3.20230808.1~deb12u1
RecoverPoint for VMs - update to 6.0.SP1.P1
HPE SimpliVity 380 Gen10 Plus - update to 2023_0913
SimpliVity Omnistack - update to 2023_0913
ucode-intel-debuginfo - addressed in versions 20230808-13.110.1, 20230808-123.1
ucode-intel-debugsource - addressed in versions 20230808-13.110.1, 20230808-123.1
ucode-intel - addressed in versions 20230808-13.110.1, 20230808-123.1, 20230808-150100.3.223.1, 20230808-150200.27.1

External References

Related Security Bulletins