CVE-2022-33196
published 2023-02-16CVE-2022-33196: Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R) Processors when using Intel(R) Software Guard Extensions which…
PriorityP425medium6.7CVSS 3.1
AVLACLPRHUINSUCHIHAH
EPSS
0.21%
11.6th percentile
Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R) Processors when using Intel(R) Software Guard Extensions which may allow a privileged user to potentially enable escalation of privilege via local access.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | intel-microcode | < intel-microcode 3.20230214.1 (bookworm) | intel-microcode 3.20230214.1 (bookworm) |
CVSS provenance
nvdv3.16.7MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
osv6.8MEDIUM
vendor_ubuntu7.5HIGH
vendor_debian7.2HIGH
vendor_redhat7.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
intel-microcode vulnerabilities
osv·2023-02-27·CVSS 6.8
CVE-2022-21216 [MEDIUM] intel-microcode vulnerabilities
intel-microcode vulnerabilities
Erik C. Bjorge discovered that some Intel(R) Atom and Intel Xeon Scalable
Processors did not properly implement access controls for out-of-band
management. This may allow a privileged network-adjacent user to potentially
escalate privileges. (CVE-2022-21216)
Cfir Cohen, Erdem Aktas, Felix Wilhelm, James Forshaw, Josh Eads, Nagaraju
Kodalapura Nagabhushana Rao, Przemyslaw Duda, Liron Shacham and Ron Anderson
discovered that some Intel(R) Xeon(R) Processors used incorrect default
permissions in some memory controller configurations when using Intel(R)
Software Guard Extensions. This may allow a privileged local user to potentially
escalate privileges. (CVE-2022-33196)
It was discovered that some 3rd Generation Intel(R) Xeon(R) Scalable Processors
did not pr
OSV
CVE-2022-33196: Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R) Processors when using Intel(R) Software Guard Extensi
osv·2023-02-16·CVSS 6.7
CVE-2022-33196 [MEDIUM] CVE-2022-33196: Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R) Processors when using Intel(R) Software Guard Extensi
Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R) Processors when using Intel(R) Software Guard Extensions which may allow a privileged user to potentially enable escalation of privilege via local access.
GHSA
GHSA-p934-6v76-mvww: Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R) Processors when using Intel(R) Software Guard Extensi
ghsa_unreviewed·2023-02-16
CVE-2022-33196 [MEDIUM] CWE-276 GHSA-p934-6v76-mvww: Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R) Processors when using Intel(R) Software Guard Extensi
Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R) Processors when using Intel(R) Software Guard Extensions which may allow a privileged user to potentially enable escalation of privilege via local access.
Ubuntu
Intel Microcode vulnerabilities
vendor_ubuntu·2023-02-27·CVSS 7.5
CVE-2022-33972 [HIGH] Intel Microcode vulnerabilities
Title: Intel Microcode vulnerabilities
Summary: Several security issues were fixed in Intel Microcode.
Erik C. Bjorge discovered that some Intel(R) Atom and Intel Xeon Scalable
Processors did not properly implement access controls for out-of-band
management. This may allow a privileged network-adjacent user to potentially
escalate privileges. (CVE-2022-21216)
Cfir Cohen, Erdem Aktas, Felix Wilhelm, James Forshaw, Josh Eads, Nagaraju
Kodalapura Nagabhushana Rao, Przemyslaw Duda, Liron Shacham and Ron Anderson
discovered that some Intel(R) Xeon(R) Processors used incorrect default
permissions in some memory controller configurations when using Intel(R)
Software Guard Extensions. This may allow a privileged local user to potentially
escalate privileges. (CVE-2022-33196)
It was discovered
Red Hat
kernel: Intel firmware update for Incorrect default permissions in some memory controller configurations
vendor_redhat·2023-02-16·CVSS 7.2
CVE-2022-33196 [HIGH] kernel: Intel firmware update for Incorrect default permissions in some memory controller configurations
kernel: Intel firmware update for Incorrect default permissions in some memory controller configurations
Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R) Processors when using Intel(R) Software Guard Extensions which may allow a privileged user to potentially enable escalation of privilege via local access.
A flaw was found in the Linux kernel. Some Intel(R) Xeon(R) processors with Intel® Software Guard Extensions (SGX) may allow privilege escalation. This issue may allow a privileged user to enable privilege escalation via local access.
Statement: Red Hat has very limited visibility and control over binary blobs provided by third-party vendors. Red Hat relies heavily on the vendors to provide timely updates and information about included
Debian
CVE-2022-33196: intel-microcode - Incorrect default permissions in some memory controller configurations for some ...
vendor_debian·2022·CVSS 7.2
CVE-2022-33196 [HIGH] CVE-2022-33196: intel-microcode - Incorrect default permissions in some memory controller configurations for some ...
Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R) Processors when using Intel(R) Software Guard Extensions which may allow a privileged user to potentially enable escalation of privilege via local access.
Scope: local
bookworm: resolved (fixed in 3.20230214.1)
bullseye: resolved (fixed in 3.20230214.1~deb11u1)
forky: resolved (fixed in 3.20230214.1)
sid: resolved (fixed in 3.20230214.1)
trixie: resolved (fixed in 3.20230214.1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-02-16
Published