Untrusted search path in Intel Server Platform Services Firmware - CVE-2023-29153

Vulnerability identifier: #VU86957

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-29153

CWE-ID: CWE-426

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to usage of an untrusted search path. A remote administrator can cause a denial of service condition on the target system.

Intel Server Platform Services Firmware
Data Lakehouse
APEX Cloud Platform for Red Hat OpenShift
APEX Cloud Platform Foundation Software

Install updates from vendor's website.

Intel Server Platform Services Firmware - update to SPS_E5_06.01.04.002.0
Data Lakehouse - addressed in versions 2.1.5, 22.5.7
APEX Cloud Platform Foundation Software - update to 03.00.04.01
APEX Cloud Platform for Red Hat OpenShift - update to 4.13.39

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01003.html

• Denial of service in Intel SPS Firmware
• Multiple vulnerabilities in Dell Data Lakehouse
• Multiple vulnerabilities in Dell APEX Cloud Platform for Red Hat OpenShift and Dell APEX Cloud Platform Foundation Software