Input validation error in Intel products - CVE-2022-44611

Vulnerability identifier: #VU79557

CSH Severity: Medium

CVSS v4: 6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-44611

CWE-ID: CWE-20

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in the BIOS firmware. A remote attacker on the local network can send specially crafted input to the application and compromise the affected system.

Intel Xeon E Processors
11th Generation Intel Core Processors
10th Generation Intel Core Processors
Intel Xeon W Processor 1300 Series
8th Generation Intel Core Processors
HPE ProLiant m750 Server Blade
HPE Apollo 4200 Gen10 Plus System
HPE ProLiant XL290n Gen10 Plus Server
HPE ProLiant XL220n Gen10 Plus Server
HPE Apollo 2000 Gen10 Plus System
HPE StoreEasy 1860 Storage
HPE StoreEasy 1660 Storage
HPE ProLiant DX380 Gen10 Plus server
HPE ProLiant DX360 Gen10 Plus server
HPE ProLiant DX220n Gen10 Plus server
Dell Edge Gateway 5200
HPE ProLiant e910 Server Blade
HPE ProLiant e910t Server Blade
HPE ProLiant DX560 Gen10 server
HPE Apollo 6500 Gen10 System
HPE Apollo 4200 Gen10 Server
HPE ProLiant XL270d Gen10 Server
HPE ProLiant XL170r Gen10 Server
HPE ProLiant XL190r Gen10 Server
HPE ProLiant XL450 Gen10 Server
HPE ProLiant XL230k Gen10 Server
HPE Apollo 4510 Gen10 System
HPE StoreEasy 1860 Performance Storage
HPE StoreEasy 1660 Performance Storage
HPE Storage Performance File Controller
HPE Storage File Controller
HPE StoreEasy 1660 Expanded Storage
HPE StoreEasy 1460 Storage
HPE StoreEasy 1560 Storage
HPE ProLiant BL460c Gen10 Server Blade
HPE Synergy 480 Gen10 Compute Module
HPE Synergy 660 Gen10 Compute Module
HPE ProLiant DX360 Gen10 server
HPE ProLiant DX380 Gen10 server
HPE ProLiant DX170r Gen10 server
HPE ProLiant DX190r Gen10 server
HPE ProLiant DX4200 Gen10 server
HPE SimpliVity 380 Gen10
HPE SimpliVity 380 Gen10 G
HPE SimpliVity 380 Gen10 H
HPE SimpliVity 190r Gen10 Server
HPE SimpliVity 170r Gen10 Server
HPE SimpliVity 380 Gen10 Plus
9th Generation Intel Core Processors
PowerEdge T30 Mini Tower Server
HPE Synergy 480 Gen10 Plus Compute Module

Install updates from vendor's website.

PowerEdge T30 Mini Tower Server - update to 1.12.0
HPE ProLiant m750 Server Blade - update to 1.60_07-24-2023
HPE Apollo 4200 Gen10 Plus System - update to 1.80_07-05-2023
HPE ProLiant XL290n Gen10 Plus Server - update to 1.80_07-05-2023
HPE ProLiant XL220n Gen10 Plus Server - update to 1.80_07-05-2023
HPE Apollo 2000 Gen10 Plus System - update to 1.80_07-05-2023
HPE StoreEasy 1860 Storage - update to 1.80_07-05-2023
HPE StoreEasy 1660 Storage - update to 1.80_07-05-2023
HPE Synergy 480 Gen10 Plus Compute Module - update to 1.80_07-05-2023
HPE ProLiant DX380 Gen10 Plus server - update to 1.80_07-05-2023
HPE ProLiant DX360 Gen10 Plus server - update to 1.80_07-05-2023
HPE ProLiant DX220n Gen10 Plus server - update to 1.80_07-05-2023
Dell Edge Gateway 5200 - update to 2.00.10
HPE ProLiant e910 Server Blade - update to 2.08_07-24-2023
HPE ProLiant e910t Server Blade - update to 2.08_07-24-2023
HPE ProLiant DX560 Gen10 server - update to 2.90_07-20-2023
HPE Apollo 6500 Gen10 System - update to 2.90_07-20-2023
HPE Apollo 4200 Gen10 Server - update to 2.90_07-20-2023
HPE ProLiant XL270d Gen10 Server - update to 2.90_07-20-2023
HPE ProLiant XL170r Gen10 Server - update to 2.90_07-20-2023
HPE ProLiant XL190r Gen10 Server - update to 2.90_07-20-2023
HPE ProLiant XL450 Gen10 Server - update to 2.90_07-20-2023
HPE ProLiant XL230k Gen10 Server - update to 2.90_07-20-2023
HPE Apollo 4510 Gen10 System - update to 2.90_07-20-2023
HPE StoreEasy 1860 Performance Storage - update to 2.90_07-20-2023
HPE StoreEasy 1660 Performance Storage - update to 2.90_07-20-2023
HPE Storage Performance File Controller - update to 2.90_07-20-2023
HPE Storage File Controller - update to 2.90_07-20-2023
HPE StoreEasy 1660 Expanded Storage - update to 2.90_07-20-2023
HPE StoreEasy 1460 Storage - update to 2.90_07-20-2023
HPE StoreEasy 1560 Storage - update to 2.90_07-20-2023
HPE ProLiant BL460c Gen10 Server Blade - update to 2.90_07-20-2023
HPE Synergy 480 Gen10 Compute Module - update to 2.90_07-20-2023
HPE Synergy 660 Gen10 Compute Module - update to 2.90_07-20-2023
HPE ProLiant DX360 Gen10 server - update to 2.90_07-20-2023
HPE ProLiant DX380 Gen10 server - update to 2.90_07-20-2023
HPE ProLiant DX170r Gen10 server - update to 2.90_07-20-2023
HPE ProLiant DX190r Gen10 server - update to 2.90_07-20-2023
HPE ProLiant DX4200 Gen10 server - update to 2.90_07-20-2023
HPE SimpliVity 380 Gen10 - update to 2023_0913
HPE SimpliVity 380 Gen10 G - update to 2023_0913
HPE SimpliVity 380 Gen10 H - update to 2023_0913
HPE SimpliVity 190r Gen10 Server - update to 2023_0913
HPE SimpliVity 170r Gen10 Server - update to 2023_0913
HPE SimpliVity 380 Gen10 Plus - update to 2023_0913

• http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00813.html

• Multiple vulnerabilities in Intel BIOS firmware
• Multiple vulnerabilities in Dell PowerEdge T30 Mini Tower Server
• Multiple vulnerabilities in HPE SimpliVity servers
• Multiple vulnerabilities in Certain HPE Synergy Servers Using Certain Intel Processors
• Multiple vulnerabilities in Certain HPE ProLiant DX Servers Using Certain Intel Processors
• Multiple vulnerabilities in Certain HPE Moonshot/Edgeline Servers Using Certain Intel Processors
• Multiple vulnerabilities in Certain HPE StoreEasy Servers Using Certain Intel Processors
• Multiple vulnerabilities in Certain HPE Apollo, XL Servers Using Certain Intel Processors
• Multiple vulnerabilities in Dell Networking Products