CVSS: 6.5EPSS: 0%CPEs: 1575EXPL: 2CVE-2022-40982 – hw: Intel: Gather Data Sampling (GDS) side channel vulnerability
https://notcve.org/view.php?id=CVE-2022-40982
Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. La exposición de información a través del estado microarquitectónico tras la ejecución transitoria en determinadas unidades de ejecución vectorial de algunos procesadores Intel(R) puede permitir a un usuario autenticado la divulgación potencial de información a través del acceso local. A Gather Data Sampling (GDS) transient execution side-channel vulnerability was found affecting certain Intel processors. This issue may allow a local attacker using gather instruction (load from memory) to infer stale data from previously used vector registers on the same physical core. • http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00828.html https://access.redhat.com/solutions/7027704 https://aws.amazon.com/security/security-bulletins/AWS-2023-007 https://downfall.page https://lists.debian.org/debian-lts-announce/2023/08/msg00013.html https://lists.debian.org/debian-lts-announce/2023/08/msg00026.html https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HKKYIK2EASDNUV4I7EFJKNBVO3KCKGRR https://lists.fedoraproject.org • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-203: Observable Discrepancy CWE-1342: Information Exposure through Microarchitectural State after Transient Execution •
CVSS: 4.4EPSS: 0%CPEs: 2024EXPL: 0CVE-2022-43505
https://notcve.org/view.php?id=CVE-2022-43505
Insufficient control flow management in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable denial of service via local access. La gestión insuficiente del flujo de control en el firmware de la BIOS para algunos procesadores Intel(R) puede permitir que un usuario con privilegios habilite potencialmente la denegación de servicio mediante acceso local. • http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00813.html https://security.netapp.com/advisory/ntap-20230824-0001 • CWE-691: Insufficient Control Flow Management •
CVSS: 7.8EPSS: 0%CPEs: 569EXPL: 0CVE-2022-29871
https://notcve.org/view.php?id=CVE-2022-29871
Improper access control in the Intel(R) CSME software installer before version 2239.3.7.0 may allow an authenticated user to potentially enable escalation of privilege via local access. Un control de acceso inadecuado en el instalador del software Intel(R) CSME anterior a la versión 2239.3.7.0 puede permitir que un usuario autenticado habilite potencialmente una escalada de privilegios mediante acceso local. • http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00783.html https://security.netapp.com/advisory/ntap-20230824-0002 • CWE-284: Improper Access Control CWE-863: Incorrect Authorization •
CVSS: 5.5EPSS: 0%CPEs: 934EXPL: 0CVE-2022-38087
https://notcve.org/view.php?id=CVE-2022-38087
Exposure of resource to wrong sphere in BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access. • https://security.netapp.com/advisory/ntap-20231124-0006 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00807.html • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 6.0EPSS: 0%CPEs: 668EXPL: 0CVE-2022-21233 – hw: cpu: Intel: Stale Data Read from legacy xAPIC vulnerability
https://notcve.org/view.php?id=CVE-2022-21233
Improper isolation of shared resources in some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access. Un aislamiento inapropiado de los recursos compartidos en algunos procesadores Intel(R) puede permitir que un usuario privilegiado permita potencialmente la divulgación de información a través del acceso local. A flaw was found in hw. The APIC can operate in xAPIC mode (also known as a legacy mode), in which APIC configuration registers are exposed through a memory-mapped I/O (MMIO) page. This flaw allows an attacker who can execute code on a target CPU to query the APIC configuration page. • https://lists.debian.org/debian-lts-announce/2023/04/msg00000.html https://security.netapp.com/advisory/ntap-20220923-0002 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00657.html https://access.redhat.com/security/cve/CVE-2022-21233 https://bugzilla.redhat.com/show_bug.cgi?id=2115640 https://access.redhat.com/solutions/6971358 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •