Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard Extensions may allow a privileged user to potentially enable information disclosure via local access.

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the microcode_ctl-20230214-1.el9 build changelog.

  - Insufficient granularity of access control in out-of-band management in some Intel(R) Atom and Intel Xeon     Scalable Processors may allow a privileged user to potentially enable escalation of privilege via adjacent     network access. (CVE-2022-21216)

  - Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R)     Processors when using Intel(R) Software Guard Extensions which may allow a privileged user to potentially     enable escalation of privilege via local access. (CVE-2022-33196)

  - Incorrect calculation in microcode keying mechanism for some 3rd Generation Intel(R) Xeon(R) Scalable     Processors may allow a privileged user to potentially enable information disclosure via local access.
    (CVE-2022-33972)

  - Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard     Extensions may allow a privileged user to potentially enable information disclosure via local access.
    (CVE-2022-38090)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-189 advisory.

  - Insufficient granularity of access control in out-of-band management in some Intel(R) Atom and Intel Xeon     Scalable Processors may allow a privileged user to potentially enable escalation of privilege via adjacent     network access. (CVE-2022-21216)

  - Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R)     Processors when using Intel(R) Software Guard Extensions which may allow a privileged user to potentially     enable escalation of privilege via local access. (CVE-2022-33196)

  - Incorrect calculation in microcode keying mechanism for some 3rd Generation Intel(R) Xeon(R) Scalable     Processors may allow a privileged user to potentially enable information disclosure via local access.
    (CVE-2022-33972)

  - Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard     Extensions may allow a privileged user to potentially enable information disclosure via local access.
    (CVE-2022-38090)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of microcode_ctl installed on the remote host is prior to 2.1-47. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2056 advisory.

  - Insufficient granularity of access control in out-of-band management in some Intel(R) Atom and Intel Xeon     Scalable Processors may allow a privileged user to potentially enable escalation of privilege via adjacent     network access. (CVE-2022-21216)

  - Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R)     Processors when using Intel(R) Software Guard Extensions which may allow a privileged user to potentially     enable escalation of privilege via local access. (CVE-2022-33196)

  - Incorrect calculation in microcode keying mechanism for some 3rd Generation Intel(R) Xeon(R) Scalable     Processors may allow a privileged user to potentially enable information disclosure via local access.
    (CVE-2022-33972)

  - Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard     Extensions may allow a privileged user to potentially enable information disclosure via local access.
    (CVE-2022-38090)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-b28dc472b0 advisory.

  - Insufficient granularity of access control in out-of-band management in some Intel(R) Atom and Intel Xeon     Scalable Processors may allow a privileged user to potentially enable escalation of privilege via adjacent     network access. (CVE-2022-21216)

  - Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R)     Processors when using Intel(R) Software Guard Extensions which may allow a privileged user to potentially     enable escalation of privilege via local access. (CVE-2022-33196)

  - Incorrect calculation in microcode keying mechanism for some 3rd Generation Intel(R) Xeon(R) Scalable     Processors may allow a privileged user to potentially enable information disclosure via local access.
    (CVE-2022-33972)

  - Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard     Extensions may allow a privileged user to potentially enable information disclosure via local access.
    (CVE-2022-38090)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-6846a1db56 advisory.

  - Insufficient granularity of access control in out-of-band management in some Intel(R) Atom and Intel Xeon     Scalable Processors may allow a privileged user to potentially enable escalation of privilege via adjacent     network access. (CVE-2022-21216)

  - Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R)     Processors when using Intel(R) Software Guard Extensions which may allow a privileged user to potentially     enable escalation of privilege via local access. (CVE-2022-33196)

  - Incorrect calculation in microcode keying mechanism for some 3rd Generation Intel(R) Xeon(R) Scalable     Processors may allow a privileged user to potentially enable information disclosure via local access.
    (CVE-2022-33972)

  - Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard     Extensions may allow a privileged user to potentially enable information disclosure via local access.
    (CVE-2022-38090)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of microcode_ctl installed on the remote host is prior to 2.1-47.41. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1715 advisory.

  - Insufficient granularity of access control in out-of-band management in some Intel(R) Atom and Intel Xeon     Scalable Processors may allow a privileged user to potentially enable escalation of privilege via adjacent     network access. (CVE-2022-21216)

  - Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R)     Processors when using Intel(R) Software Guard Extensions which may allow a privileged user to potentially     enable escalation of privilege via local access. (CVE-2022-33196)

  - Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard     Extensions may allow a privileged user to potentially enable information disclosure via local access.
    (CVE-2022-38090)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3379 advisory.

  - Insufficient granularity of access control in out-of-band management in some Intel(R) Atom and Intel Xeon     Scalable Processors may allow a privileged user to potentially enable escalation of privilege via adjacent     network access. (CVE-2022-21216)

  - Improper isolation of shared resources in some Intel(R) Processors may allow a privileged user to     potentially enable information disclosure via local access. (CVE-2022-21233)

  - Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R)     Processors when using Intel(R) Software Guard Extensions which may allow a privileged user to potentially     enable escalation of privilege via local access. (CVE-2022-33196)

  - Incorrect calculation in microcode keying mechanism for some 3rd Generation Intel(R) Xeon(R) Scalable     Processors may allow a privileged user to potentially enable information disclosure via local access.
    (CVE-2022-33972)

  - Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard     Extensions may allow a privileged user to potentially enable information disclosure via local access.
    (CVE-2022-38090)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0568-1 advisory.

  - Insufficient granularity of access control in out-of-band management in some Intel(R) Atom and Intel Xeon     Scalable Processors may allow a privileged user to potentially enable escalation of privilege via adjacent     network access. (CVE-2022-21216)

  - Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R)     Processors when using Intel(R) Software Guard Extensions which may allow a privileged user to potentially     enable escalation of privilege via local access. (CVE-2022-33196)

  - Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard     Extensions may allow a privileged user to potentially enable information disclosure via local access.
    (CVE-2022-38090)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5886-1 advisory.

  - Insufficient granularity of access control in out-of-band management in some Intel(R) Atom and Intel Xeon     Scalable Processors may allow a privileged user to potentially enable escalation of privilege via adjacent     network access. (CVE-2022-21216)

  - Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R)     Processors when using Intel(R) Software Guard Extensions which may allow a privileged user to potentially     enable escalation of privilege via local access. (CVE-2022-33196)

  - Incorrect calculation in microcode keying mechanism for some 3rd Generation Intel(R) Xeon(R) Scalable     Processors may allow a privileged user to potentially enable information disclosure via local access.
    (CVE-2022-33972)

  - Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard     Extensions may allow a privileged user to potentially enable information disclosure via local access.
    (CVE-2022-38090)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0455-1 advisory.

  - Insufficient granularity of access control in out-of-band management in some Intel(R) Atom and Intel Xeon     Scalable Processors may allow a privileged user to potentially enable escalation of privilege via adjacent     network access. (CVE-2022-21216)

  - Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R)     Processors when using Intel(R) Software Guard Extensions which may allow a privileged user to potentially     enable escalation of privilege via local access. (CVE-2022-33196)

  - Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard     Extensions may allow a privileged user to potentially enable information disclosure via local access.
    (CVE-2022-38090)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0456-1 advisory.

  - Insufficient granularity of access control in out-of-band management in some Intel(R) Atom and Intel Xeon     Scalable Processors may allow a privileged user to potentially enable escalation of privilege via adjacent     network access. (CVE-2022-21216)

  - Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R)     Processors when using Intel(R) Software Guard Extensions which may allow a privileged user to potentially     enable escalation of privilege via local access. (CVE-2022-33196)

  - Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard     Extensions may allow a privileged user to potentially enable information disclosure via local access.
    (CVE-2022-38090)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0454-1 advisory.

  - Insufficient granularity of access control in out-of-band management in some Intel(R) Atom and Intel Xeon     Scalable Processors may allow a privileged user to potentially enable escalation of privilege via adjacent     network access. (CVE-2022-21216)

  - Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R)     Processors when using Intel(R) Software Guard Extensions which may allow a privileged user to potentially     enable escalation of privilege via local access. (CVE-2022-33196)

  - Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard     Extensions may allow a privileged user to potentially enable information disclosure via local access.
    (CVE-2022-38090)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
195662	RHEL 6 : kernel (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
191341	CentOS 9 : microcode_ctl-20230214-1.el9	Nessus	CentOS Local Security Checks	medium
176950	Amazon Linux 2023 : microcode_ctl (ALAS2023-2023-189)	Nessus	Amazon Linux Local Security Checks	medium
176705	Amazon Linux 2 : microcode_ctl (ALAS-2023-2056)	Nessus	Amazon Linux Local Security Checks	medium
176460	Fedora 37 : microcode_ctl (2023-b28dc472b0)	Nessus	Fedora Local Security Checks	medium
176426	Fedora 38 : microcode_ctl (2023-6846a1db56)	Nessus	Fedora Local Security Checks	medium
173966	Amazon Linux AMI : microcode_ctl (ALAS-2023-1715)	Nessus	Amazon Linux Local Security Checks	medium
173778	Debian DLA-3379-1 : intel-microcode - LTS security update	Nessus	Debian Local Security Checks	medium
172013	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : ucode-intel (SUSE-SU-2023:0568-1)	Nessus	SuSE Local Security Checks	medium
171928	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS : Intel Microcode vulnerabilities (USN-5886-1)	Nessus	Ubuntu Local Security Checks	medium
171688	SUSE SLES12 Security Update : ucode-intel (SUSE-SU-2023:0455-1)	Nessus	SuSE Local Security Checks	medium
171687	SUSE SLES12 Security Update : ucode-intel (SUSE-SU-2023:0456-1)	Nessus	SuSE Local Security Checks	medium
171680	SUSE SLES15 Security Update : ucode-intel (SUSE-SU-2023:0454-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2022-38090

medium

Tenable Plugins

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium