Buffer overflow in Intel products - CVE-2022-27879

Vulnerability identifier: #VU79558

CSH Severity: Low

CVSS v4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-27879

CWE-ID: CWE-120

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to a boundary error within the BIOS firmware. A local user can trigger memory corruption and gain access to sensitive information.

Intel Pentium Processor J Series
Intel Pentium Processor N Series
Intel Atom Processor E3900 Series
Intel Celeron Processor J Series
Intel Celeron Processor N Series
Intel Atom Processor A Series
HPE ProLiant m750 Server Blade
HPE Apollo 4200 Gen10 Plus System
HPE ProLiant XL290n Gen10 Plus Server
HPE ProLiant XL220n Gen10 Plus Server
HPE Apollo 2000 Gen10 Plus System
HPE StoreEasy 1860 Storage
HPE StoreEasy 1660 Storage
HPE ProLiant DX380 Gen10 Plus server
HPE ProLiant DX360 Gen10 Plus server
HPE ProLiant DX220n Gen10 Plus server
HPE ProLiant e910 Server Blade
HPE ProLiant e910t Server Blade
HPE ProLiant DX380 Gen10 server
HPE Apollo 6500 Gen10 System
HPE Apollo 4200 Gen10 Server
HPE ProLiant XL270d Gen10 Server
HPE ProLiant XL170r Gen10 Server
HPE ProLiant XL190r Gen10 Server
HPE ProLiant XL450 Gen10 Server
HPE ProLiant XL230k Gen10 Server
HPE Apollo 4510 Gen10 System
HPE StoreEasy 1860 Performance Storage
HPE StoreEasy 1660 Performance Storage
HPE Storage Performance File Controller
HPE Storage File Controller
HPE StoreEasy 1660 Expanded Storage
HPE StoreEasy 1460 Storage
HPE StoreEasy 1560 Storage
HPE ProLiant DX360 Gen10 server
HPE ProLiant BL460c Gen10 Server Blade
HPE Synergy 480 Gen10 Compute Module
HPE Synergy 660 Gen10 Compute Module
HPE ProLiant DX170r Gen10 server
HPE ProLiant DX190r Gen10 server
HPE ProLiant DX560 Gen10 server
HPE ProLiant DX4200 Gen10 server
HPE SimpliVity 380 Gen10
HPE SimpliVity 380 Gen10 G
HPE SimpliVity 380 Gen10 H
HPE SimpliVity 190r Gen10 Server
HPE SimpliVity 380 Gen10 Plus
HPE SimpliVity 170r Gen10 Server
PowerEdge T30 Mini Tower Server
HPE Synergy 480 Gen10 Plus Compute Module

Install updates from vendor's website.

PowerEdge T30 Mini Tower Server - update to 1.12.0
HPE ProLiant m750 Server Blade - update to 1.60_07-24-2023
HPE Apollo 4200 Gen10 Plus System - update to 1.80_07-05-2023
HPE ProLiant XL290n Gen10 Plus Server - update to 1.80_07-05-2023
HPE ProLiant XL220n Gen10 Plus Server - update to 1.80_07-05-2023
HPE Apollo 2000 Gen10 Plus System - update to 1.80_07-05-2023
HPE StoreEasy 1860 Storage - update to 1.80_07-05-2023
HPE StoreEasy 1660 Storage - update to 1.80_07-05-2023
HPE ProLiant DX380 Gen10 Plus server - update to 1.80_07-05-2023
HPE ProLiant DX360 Gen10 Plus server - update to 1.80_07-05-2023
HPE ProLiant DX220n Gen10 Plus server - update to 1.80_07-05-2023
HPE Synergy 480 Gen10 Plus Compute Module - update to 1.80_07-05-2023
HPE ProLiant e910 Server Blade - update to 2.08_07-24-2023
HPE ProLiant e910t Server Blade - update to 2.08_07-24-2023
HPE ProLiant DX380 Gen10 server - update to 2.90_07-20-2023
HPE Apollo 6500 Gen10 System - update to 2.90_07-20-2023
HPE Apollo 4200 Gen10 Server - update to 2.90_07-20-2023
HPE ProLiant XL270d Gen10 Server - update to 2.90_07-20-2023
HPE ProLiant XL170r Gen10 Server - update to 2.90_07-20-2023
HPE ProLiant XL190r Gen10 Server - update to 2.90_07-20-2023
HPE ProLiant XL450 Gen10 Server - update to 2.90_07-20-2023
HPE ProLiant XL230k Gen10 Server - update to 2.90_07-20-2023
HPE Apollo 4510 Gen10 System - update to 2.90_07-20-2023
HPE StoreEasy 1860 Performance Storage - update to 2.90_07-20-2023
HPE StoreEasy 1660 Performance Storage - update to 2.90_07-20-2023
HPE Storage Performance File Controller - update to 2.90_07-20-2023
HPE Storage File Controller - update to 2.90_07-20-2023
HPE StoreEasy 1660 Expanded Storage - update to 2.90_07-20-2023
HPE StoreEasy 1460 Storage - update to 2.90_07-20-2023
HPE StoreEasy 1560 Storage - update to 2.90_07-20-2023
HPE ProLiant DX360 Gen10 server - update to 2.90_07-20-2023
HPE ProLiant BL460c Gen10 Server Blade - update to 2.90_07-20-2023
HPE Synergy 480 Gen10 Compute Module - update to 2.90_07-20-2023
HPE Synergy 660 Gen10 Compute Module - update to 2.90_07-20-2023
HPE ProLiant DX170r Gen10 server - update to 2.90_07-20-2023
HPE ProLiant DX190r Gen10 server - update to 2.90_07-20-2023
HPE ProLiant DX560 Gen10 server - update to 2.90_07-20-2023
HPE ProLiant DX4200 Gen10 server - update to 2.90_07-20-2023
HPE SimpliVity 380 Gen10 - update to 2023_0913
HPE SimpliVity 380 Gen10 G - update to 2023_0913
HPE SimpliVity 380 Gen10 H - update to 2023_0913
HPE SimpliVity 190r Gen10 Server - update to 2023_0913
HPE SimpliVity 380 Gen10 Plus - update to 2023_0913
HPE SimpliVity 170r Gen10 Server - update to 2023_0913

• http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00813.html

• Multiple vulnerabilities in Intel BIOS firmware
• Multiple vulnerabilities in Dell PowerEdge T30 Mini Tower Server
• Multiple vulnerabilities in HPE SimpliVity servers
• Multiple vulnerabilities in Certain HPE Synergy Servers Using Certain Intel Processors
• Multiple vulnerabilities in Certain HPE ProLiant DX Servers Using Certain Intel Processors
• Multiple vulnerabilities in Certain HPE Moonshot/Edgeline Servers Using Certain Intel Processors
• Multiple vulnerabilities in Certain HPE StoreEasy Servers Using Certain Intel Processors
• Multiple vulnerabilities in Certain HPE Apollo, XL Servers Using Certain Intel Processors