PT-2022-4322 · Intel+3 · 3Rd Generation Intel Xeon Scalable Processors+3

Published 2022-05-10 · Updated 2022-10-26 · CVE-2021-33117

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions 3rd Generation Intel(R) Xeon(R) Scalable Processors versions before MR7

Description The issue is related to improper access control in the BIOS microcode of Intel processors, which may allow a local attacker to potentially enable information disclosure via local access. This could lead to the disclosure of protected information.

Recommendations For 3rd Generation Intel(R) Xeon(R) Scalable Processors versions before MR7, update the BIOS to version MR7 or later to resolve the issue. As a temporary workaround, consider restricting local access to minimize the risk of exploitation.

Fix

Improper Initialization

Weakness Enumeration

CWE-453

CWE-1284

CWE-665

Related Identifiers

BDU:2022-04582

BDU:2022-05180

CVE-2021-33117

USN-5486-1

USN-5535-1

Affected Products

3Rd Generation Intel Xeon Scalable Processors

Astra Linux

Linuxmint

Ubuntu

References · 27

• https://security-tracker.debian.org/tracker/CVE-2021-33117 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-33117 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5535-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-33120 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-0146 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-21166 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5486-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-21123 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33117 · Security Note
• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00586.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-21125 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5535-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-21127 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05180 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-33117 · Vendor Advisory