CVE-2022-21127

Incomplete cleanup in specific special register read operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

CVSS v3.0 5.5 MEDIUM
CVSS v2.0 2.1 LOW

5.5^/10

CVSS v3.0 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00615.html	Patch Vendor Advisory
http://www.openwall.com/lists/oss-security/2022/06/16/1	Mailing List Patch Third Party Advisory
https://security.netapp.com/advisory/ntap-20220624-0008/	Third Party Advisory
https://www.debian.org/security/2022/dsa-5178

Configurations

Configuration 1 (hide)

cpe:2.3:o:xen:xen:*:*:*:*:*:*:x86:*

Configuration 2 (hide)

OR	cpe:2.3:a:intel:sgx_dcap::::::linux::*
	cpe:2.3:a:intel:sgx_dcap::::::windows::*
	cpe:2.3:a:intel:sgx_psw::::::linux::*
	cpe:2.3:a:intel:sgx_psw::::::windows::*
	cpe:2.3:a:intel:sgx_sdk::::::linux::*
	cpe:2.3:a:intel:sgx_sdk::::::windows::*

Information

Published : 2022-06-15 20:15

Updated : 2022-07-07 11:15

NVD link : CVE-2022-21127

Mitre link : CVE-2022-21127

JSON object : View

Products Affected

intel

sgx_dcap
sgx_sdk
sgx_psw

xen

xen

CWE

CWE-459

Incomplete Cleanup

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00615.html", "name": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00615.html", "tags": ["Patch", "Vendor Advisory"], "refsource": "MISC"}, {"url": "http://www.openwall.com/lists/oss-security/2022/06/16/1", "name": "[oss-security] 20220616 Xen Security Advisory 404 v2 (CVE-2022-21123,CVE-2022-21125,CVE-2022-21166) - x86: MMIO Stale Data vulnerabilities", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "refsource": "MLIST"}, {"url": "https://security.netapp.com/advisory/ntap-20220624-0008/", "name": "https://security.netapp.com/advisory/ntap-20220624-0008/", "tags": ["Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://www.debian.org/security/2022/dsa-5178", "name": "DSA-5178", "tags": [], "refsource": "DEBIAN"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Incomplete cleanup in specific special register read operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-459"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-21127", "ASSIGNER": "secure@intel.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "LOW", "acInsufInfo": false, "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}}, "publishedDate": "2022-06-15T20:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:xen:xen:*:*:*:*:*:*:x86:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:intel:sgx_dcap:*:*:*:*:*:linux:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "1.14.100.3"}, {"cpe23Uri": "cpe:2.3:a:intel:sgx_dcap:*:*:*:*:*:windows:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "1.14.100.3"}, {"cpe23Uri": "cpe:2.3:a:intel:sgx_psw:*:*:*:*:*:linux:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2.17.100.3"}, {"cpe23Uri": "cpe:2.3:a:intel:sgx_psw:*:*:*:*:*:windows:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2.16.100.3"}, {"cpe23Uri": "cpe:2.3:a:intel:sgx_sdk:*:*:*:*:*:linux:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2.17.100.3"}, {"cpe23Uri": "cpe:2.3:a:intel:sgx_sdk:*:*:*:*:*:windows:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2.16.100.3"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2022-07-07T11:15Z"}