CVE-2022-21127

Incomplete cleanup in specific special register read operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

CVSS v3 5.5 MEDIUM
CVSS v2.0 2.1 LOW

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.openwall.com/lists/oss-security/2022/06/16/1	Mailing List Patch Third Party Advisory
https://security.netapp.com/advisory/ntap-20220624-0008/	Third Party Advisory
https://www.debian.org/security/2022/dsa-5178	Third Party Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00615.html	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:xen:xen:*:*:*:*:*:*:x86:*

Configuration 2 (hide)

OR	cpe:2.3:a:intel:sgx_dcap::::::linux::*
	cpe:2.3:a:intel:sgx_dcap::::::windows::*
	cpe:2.3:a:intel:sgx_psw::::::windows::*
	cpe:2.3:a:intel:sgx_psw::::::linux::*
	cpe:2.3:a:intel:sgx_sdk::::::windows::*
	cpe:2.3:a:intel:sgx_sdk::::::linux::*

Configuration 3 (hide)

OR	cpe:2.3:o:debian:debian_linux:10.0:::::::*
	cpe:2.3:o:debian:debian_linux:11.0:::::::*

History

No history.

Information

Published : 2022-06-15 20:15

Updated : 2024-02-28 19:09

NVD link : CVE-2022-21127

Mitre link : CVE-2022-21127

CVE.ORG link : CVE-2022-21127

JSON object : View

Products Affected

xen

xen

intel

sgx_sdk
sgx_psw
sgx_dcap

debian

debian_linux

CWE

CWE-459

Incomplete Cleanup

{"id": "CVE-2022-21127", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2022-06-15T20:15:17.587", "references": [{"url": "http://www.openwall.com/lists/oss-security/2022/06/16/1", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "source": "secure@intel.com"}, {"url": "https://security.netapp.com/advisory/ntap-20220624-0008/", "tags": ["Third Party Advisory"], "source": "secure@intel.com"}, {"url": "https://www.debian.org/security/2022/dsa-5178", "tags": ["Third Party Advisory"], "source": "secure@intel.com"}, {"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00615.html", "tags": ["Patch", "Vendor Advisory"], "source": "secure@intel.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-459"}]}], "descriptions": [{"lang": "en", "value": "Incomplete cleanup in specific special register read operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access."}, {"lang": "es", "value": "Una limpieza incompleta en operaciones espec\u00edficas de lectura de registros especiales para algunos procesadores Intel(R) puede permitir que un usuario autenticado permita potencialmente la divulgaci\u00f3n de informaci\u00f3n por medio de acceso local"}], "lastModified": "2023-01-31T17:27:41.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:xen:xen:*:*:*:*:*:*:x86:*", "vulnerable": true, "matchCriteriaId": "EF4E17C2-244F-4E5A-A5F8-4626CD1AC11A"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:intel:sgx_dcap:*:*:*:*:*:linux:*:*", "vulnerable": true, "matchCriteriaId": "95D27137-9FE9-4036-95C5-28B8502A50BA", "versionEndExcluding": "1.14.100.3"}, {"criteria": "cpe:2.3:a:intel:sgx_dcap:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "7461CA21-255D-4825-AE70-E3EB5D05945E", "versionEndExcluding": "1.14.100.3"}, {"criteria": "cpe:2.3:a:intel:sgx_psw:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "66C56CBD-F718-43A4-B097-291D2D6BBD0E", "versionEndExcluding": "2.16.100.3"}, {"criteria": "cpe:2.3:a:intel:sgx_psw:*:*:*:*:*:linux:*:*", "vulnerable": true, "matchCriteriaId": "54F078D2-1BA0-4784-9650-6680ACD84FF6", "versionEndExcluding": "2.17.100.3"}, {"criteria": "cpe:2.3:a:intel:sgx_sdk:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "CF5F9EC2-3359-4364-AB06-64A528AAAE51", "versionEndExcluding": "2.16.100.3"}, {"criteria": "cpe:2.3:a:intel:sgx_sdk:*:*:*:*:*:linux:*:*", "vulnerable": true, "matchCriteriaId": "0C7F6964-55CF-4BD2-B483-EA6FE9564037", "versionEndExcluding": "2.17.100.3"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"}, {"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"}], "operator": "OR"}]}], "sourceIdentifier": "secure@intel.com"}