Insufficient Control Flow Management in 4th Generation Intel Xeon Scalable Processors and 5th Generation Intel Xeon Scalable processors - CVE-2024-22374

Vulnerability identifier: #VU96258

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-22374

CWE-ID: CWE-691

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient control flow management for some Intel Xeon Processors. A local user can perform a denial of service (DoS) attack.

4th Generation Intel Xeon Scalable Processors
5th Generation Intel Xeon Scalable processors
Precision 7960 XL Rack
Precision 7960 Tower
Precision 5860 Tower
HPE StoreEasy 1670 Storage
HPE ProLiant DX320 Gen11 server
HPE ProLiant DX360 Gen11 server
HPE ProLiant DX380a Gen11 server
HPE ProLiant DX380 Gen11 server
HPE ProLiant DX560 Gen11 server
HPE ProLiant DX4120 Gen11 server
HPE Compute Edge Server e930t
HPE Synergy 480 Gen11 Compute Module
HPE Alletra 4140
HPE Alletra 4120
HPE Alletra 4110
HPE ProLiant ML350 Gen11 Server
HPE ProLiant ML110 Gen11
HPE ProLiant DL560 Gen11
HPE ProLiant DL380a Gen11
HPE ProLiant DL380 Gen11 Server
HPE ProLiant DL360 Gen11 Server
HPE ProLiant DL320 Gen11 Server
HPE ProLiant DL110 Gen11
HPE StoreEasy 1870 Storage
HPE StoreEasy 1870 Performance Storage
HPE StoreEasy 1670 Performance Storage
HPE SimpliVity 380 Gen11
APEX Cloud Platform for Microsoft Azure
Precision 7960 Rack

Install updates from vendor's website.

APEX Cloud Platform for Microsoft Azure - update to 01.03.00.00
Precision 7960 XL Rack - update to 2.2.7
Precision 7960 Rack - update to 2.2.7
Precision 7960 Tower - update to 2.2.9
Precision 5860 Tower - update to 2.2.9
HPE StoreEasy 1670 Storage - update to 2.20_05-27-2024
HPE ProLiant DX320 Gen11 server - update to 2.20_05-27-2024
HPE ProLiant DX360 Gen11 server - update to 2.20_05-27-2024
HPE ProLiant DX380a Gen11 server - update to 2.20_05-27-2024
HPE ProLiant DX380 Gen11 server - update to 2.20_05-27-2024
HPE ProLiant DX560 Gen11 server - update to 2.20_05-27-2024
HPE ProLiant DX4120 Gen11 server - update to 2.20_05-27-2024
HPE Compute Edge Server e930t - update to 2.20_05-27-2024
HPE Synergy 480 Gen11 Compute Module - update to 2.20_05-27-2024
HPE Alletra 4140 - update to 2.20_05-27-2024
HPE Alletra 4120 - update to 2.20_05-27-2024
HPE Alletra 4110 - update to 2.20_05-27-2024
HPE ProLiant ML350 Gen11 Server - update to 2.20_05-27-2024
HPE ProLiant ML110 Gen11 - update to 2.20_05-27-2024
HPE ProLiant DL560 Gen11 - update to 2.20_05-27-2024
HPE ProLiant DL380a Gen11 - update to 2.20_05-27-2024
HPE ProLiant DL380 Gen11 Server - update to 2.20_05-27-2024
HPE ProLiant DL360 Gen11 Server - update to 2.20_05-27-2024
HPE ProLiant DL320 Gen11 Server - update to 2.20_05-27-2024
HPE ProLiant DL110 Gen11 - update to 2.20_05-27-2024
HPE StoreEasy 1870 Storage - update to 2.20_05-27-2024
HPE StoreEasy 1870 Performance Storage - update to 2.20_05-27-2024
HPE StoreEasy 1670 Performance Storage - update to 2.20_05-27-2024
HPE SimpliVity 380 Gen11 - update to 2024_0830

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01073.html

• Local denial of service in Intel Xeon processors
• HPE StoreEasy servers update for Intel microcode
• HPE ProLiant, Alletra, Synergy, and Edgeline servers update for Intel microcode
• Local denial of service in HPE ProLiant DX servers
• Multiple vulnerabilities in Dell APEX Cloud Platform for Microsoft Azure
• Multiple vulnerabilities in Dell Precision Rack for Intel TDX Module Software and Intel Xeon Processor
• Insufficient Control Flow Management in Dell Client Platform for an Intel Xeon Processor
• Insufficient Control Flow Management in HPE SimpliVity Servers Using Certain Intel Processors