Improper Initialization in Intel products - CVE-2022-38083

Vulnerability identifier: #VU79559

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-38083

CWE-ID: CWE-665

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper initialization in the BIOS firmware. A local user can run a specially crafted application to execute arbitrary code with escalated privileges on the system.

Intel Xeon Processor E7 v4 Family
Intel Xeon Processor E5 v4 Family
Intel Core X-series Processor
Intel Xeon Processor E7 v3 Family
Intel Xeon Processor E5 v3 Family
Intel Xeon D Processors
Intel Xeon D-1633N Processor
HPE ProLiant m750 Server Blade
HPE Apollo 4200 Gen10 Plus System
HPE StoreEasy 1860 Storage
HPE ProLiant XL290n Gen10 Plus Server
HPE ProLiant XL220n Gen10 Plus Server
HPE Apollo 2000 Gen10 Plus System
HPE StoreEasy 1660 Storage
HPE ProLiant DX380 Gen10 Plus server
HPE ProLiant DX360 Gen10 Plus server
HPE ProLiant DX220n Gen10 Plus server
HPE ProLiant e910t Server Blade
HPE ProLiant e910 Server Blade
Precision 7960 XL Rack
Precision 7920 Rack
Precision 7920 XL Rack
HPE StoreEasy 1560 Storage
HPE Apollo 4510 Gen10 System
HPE ProLiant XL230k Gen10 Server
HPE ProLiant XL450 Gen10 Server
HPE ProLiant XL190r Gen10 Server
HPE ProLiant XL170r Gen10 Server
HPE ProLiant XL270d Gen10 Server
HPE Apollo 4200 Gen10 Server
HPE Apollo 6500 Gen10 System
HPE StoreEasy 1860 Performance Storage
HPE StoreEasy 1660 Performance Storage
HPE Storage File Controller
HPE ProLiant BL460c Gen10 Server Blade
HPE Synergy 480 Gen10 Compute Module
HPE Synergy 660 Gen10 Compute Module
HPE ProLiant DX360 Gen10 server
HPE ProLiant DX380 Gen10 server
HPE ProLiant DX4200 Gen10 server
HPE ProLiant DX560 Gen10 server
HPE ProLiant DX190r Gen10 server
HPE ProLiant DX170r Gen10 server
HPE StoreEasy 1460 Storage
HPE StoreEasy 1660 Expanded Storage
HPE Storage Performance File Controller
HPE SimpliVity 380 Gen10
HPE SimpliVity 380 Gen10 Plus
HPE SimpliVity 170r Gen10 Server
HPE SimpliVity 190r Gen10 Server
HPE SimpliVity 380 Gen10 H
HPE SimpliVity 380 Gen10 G
HPE Synergy 480 Gen10 Plus Compute Module
Precision 7960 Rack

Install updates from vendor's website.

HPE ProLiant m750 Server Blade - update to 1.60_07-24-2023
HPE Apollo 4200 Gen10 Plus System - update to 1.80_07-05-2023
HPE StoreEasy 1860 Storage - update to 1.80_07-05-2023
HPE ProLiant XL290n Gen10 Plus Server - update to 1.80_07-05-2023
HPE ProLiant XL220n Gen10 Plus Server - update to 1.80_07-05-2023
HPE Apollo 2000 Gen10 Plus System - update to 1.80_07-05-2023
HPE Synergy 480 Gen10 Plus Compute Module - update to 1.80_07-05-2023
HPE StoreEasy 1660 Storage - update to 1.80_07-05-2023
HPE ProLiant DX380 Gen10 Plus server - update to 1.80_07-05-2023
HPE ProLiant DX360 Gen10 Plus server - update to 1.80_07-05-2023
HPE ProLiant DX220n Gen10 Plus server - update to 1.80_07-05-2023
HPE ProLiant e910t Server Blade - update to 2.08_07-24-2023
HPE ProLiant e910 Server Blade - update to 2.08_07-24-2023
Precision 7960 XL Rack - update to 2.19.1
Precision 7920 Rack - update to 2.19.1
Precision 7920 XL Rack - update to 2.19.1
Precision 7960 Rack - update to 2.19.1
HPE StoreEasy 1560 Storage - update to 2.90_07-20-2023
HPE Apollo 4510 Gen10 System - update to 2.90_07-20-2023
HPE ProLiant XL230k Gen10 Server - update to 2.90_07-20-2023
HPE ProLiant XL450 Gen10 Server - update to 2.90_07-20-2023
HPE ProLiant XL190r Gen10 Server - update to 2.90_07-20-2023
HPE ProLiant XL170r Gen10 Server - update to 2.90_07-20-2023
HPE ProLiant XL270d Gen10 Server - update to 2.90_07-20-2023
HPE Apollo 4200 Gen10 Server - update to 2.90_07-20-2023
HPE Apollo 6500 Gen10 System - update to 2.90_07-20-2023
HPE StoreEasy 1860 Performance Storage - update to 2.90_07-20-2023
HPE StoreEasy 1660 Performance Storage - update to 2.90_07-20-2023
HPE Storage File Controller - update to 2.90_07-20-2023
HPE ProLiant BL460c Gen10 Server Blade - update to 2.90_07-20-2023
HPE Synergy 480 Gen10 Compute Module - update to 2.90_07-20-2023
HPE Synergy 660 Gen10 Compute Module - update to 2.90_07-20-2023
HPE ProLiant DX360 Gen10 server - update to 2.90_07-20-2023
HPE ProLiant DX380 Gen10 server - update to 2.90_07-20-2023
HPE ProLiant DX4200 Gen10 server - update to 2.90_07-20-2023
HPE ProLiant DX560 Gen10 server - update to 2.90_07-20-2023
HPE ProLiant DX190r Gen10 server - update to 2.90_07-20-2023
HPE ProLiant DX170r Gen10 server - update to 2.90_07-20-2023
HPE StoreEasy 1460 Storage - update to 2.90_07-20-2023
HPE StoreEasy 1660 Expanded Storage - update to 2.90_07-20-2023
HPE Storage Performance File Controller - update to 2.90_07-20-2023
HPE SimpliVity 380 Gen10 - update to 2023_0913
HPE SimpliVity 380 Gen10 Plus - update to 2023_0913
HPE SimpliVity 170r Gen10 Server - update to 2023_0913
HPE SimpliVity 190r Gen10 Server - update to 2023_0913
HPE SimpliVity 380 Gen10 H - update to 2023_0913
HPE SimpliVity 380 Gen10 G - update to 2023_0913

• http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00813.html

• Multiple vulnerabilities in Intel BIOS firmware
• Multiple vulnerabilities in HPE SimpliVity servers
• Multiple vulnerabilities in Certain HPE Synergy Servers Using Certain Intel Processors
• Multiple vulnerabilities in Certain HPE ProLiant DX Servers Using Certain Intel Processors
• Multiple vulnerabilities in Certain HPE Moonshot/Edgeline Servers Using Certain Intel Processors
• Multiple vulnerabilities in Certain HPE StoreEasy Servers Using Certain Intel Processors
• Multiple vulnerabilities in Dell Precision Rack BIOS
• Multiple vulnerabilities in Certain HPE Apollo, XL Servers Using Certain Intel Processors