CVE-2023-22655 - OpenCVE

Protection mechanism failure in some 3rd and 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege via local access.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Redhat	Enterprise Linux

No data.

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 9
microcode_ctl-4:20240910-1.el9_5	cpe:/o:redhat:enterprise_linux:9	RHSA-2024:9401	2024-11-12T00:00:00Z

References

Link	Providers
https://lists.debian.org/debian-lts-announce/2024/05/msg00003.html
https://nvd.nist.gov/vuln/detail/CVE-2023-22655
https://security.netapp.com/advisory/ntap-20240405-0006/
https://www.cve.org/CVERecord?id=CVE-2023-22655
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00960.html

History

Wed, 13 Nov 2024 02:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Redhat Redhat enterprise Linux
CPEs		cpe:/o:redhat:enterprise_linux:9
Vendors & Products		Redhat Redhat enterprise Linux

MITRE

Status: PUBLISHED

Assigner: intel

Published: 2024-03-14T16:45:46.683Z

Updated: 2024-08-28T18:17:37.653Z

Reserved: 2023-01-27T04:00:04.248Z

Link: CVE-2023-22655

Vulnrichment

Updated: 2024-08-02T10:13:49.758Z

NVD

Status : Awaiting Analysis

Published: 2024-03-14T17:15:49.930

Modified: 2024-05-04T16:15:14.887

Link: CVE-2023-22655

Redhat

Severity : Moderate

Publid Date: 2024-03-12T00:00:00Z

Links: CVE-2023-22655 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-22655", "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce", "state": "PUBLISHED", "assignerShortName": "intel", "dateReserved": "2023-01-27T04:00:04.248Z", "datePublished": "2024-03-14T16:45:46.683Z", "dateUpdated": "2024-08-28T18:17:37.653Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce", "shortName": "intel", "dateUpdated": "2024-03-14T16:45:46.683Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "escalation of privilege"}, {"lang": "en", "description": "Protection mechanism failure", "cweId": "CWE-693", "type": "CWE"}]}], "affected": [{"vendor": "n/a", "product": "3rd and 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Intel(R) TDX", "versions": [{"version": "See references", "status": "affected"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Protection mechanism failure in some 3rd and 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege via local access."}], "references": [{"name": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00960.html", "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00960.html"}, {"url": "https://security.netapp.com/advisory/ntap-20240405-0006/"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/05/msg00003.html"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:13:49.758Z"}, "title": "CVE Program Container", "references": [{"name": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00960.html", "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00960.html", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20240405-0006/", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/05/msg00003.html", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "intel", "product": "3rd_gen_intel_xeon_scalable_processor_family", "cpes": ["cpe:2.3:a:intel:3rd_gen_intel_xeon_scalable_processor_family:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "*", "versionType": "custom"}]}, {"vendor": "intel", "product": "xeon_d_processor", "cpes": ["cpe:2.3:h:intel:xeon_d_processor:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "*", "versionType": "custom"}]}, {"vendor": "intel", "product": "4th_generation_intel_xeon_platinum_processors", "cpes": ["cpe:2.3:h:intel:4th_generation_intel_xeon_platinum_processors:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "*", "versionType": "custom"}]}, {"vendor": "intel", "product": "4th_generation_intel_xeon_gold_processors", "cpes": ["cpe:2.3:h:intel:4th_generation_intel_xeon_gold_processors:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "*", "versionType": "custom"}]}, {"vendor": "intel", "product": "4th_gen_intel_xeon_scalable_processors", "cpes": ["cpe:2.3:h:intel:4th_gen_intel_xeon_scalable_processors:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "*", "versionType": "custom"}]}, {"vendor": "intel", "product": "4th_gen_intel_xeon_platinum_processors", "cpes": ["cpe:2.3:h:intel:4th_gen_intel_xeon_platinum_processors:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "*", "versionType": "custom"}]}, {"vendor": "intel", "product": "4th_gen_intel_xeon_gold_processors", "cpes": ["cpe:2.3:h:intel:4th_gen_intel_xeon_gold_processors:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "*", "versionType": "custom"}]}, {"vendor": "intel", "product": "4th_gen_intel_xeon_silver_processors", "cpes": ["cpe:2.3:h:intel:4th_gen_intel_xeon_silver_processors:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "*", "versionType": "custom"}]}, {"vendor": "intel", "product": "4th_gen_intel_xeon_bronze_processors", "cpes": ["cpe:2.3:h:intel:4th_gen_intel_xeon_bronze_processors:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "*", "versionType": "custom"}]}, {"vendor": "intel", "product": "xeon_cpu_max_series_processors", "cpes": ["cpe:2.3:h:intel:xeon_cpu_max_series_processors:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "*", "versionType": "custom"}]}, {"vendor": "intel", "product": "4th_gen_intel_xeon_scalable_processors_with_intel_vran", "cpes": ["cpe:2.3:h:intel:4th_gen_intel_xeon_scalable_processors_with_intel_vran:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "*", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-03-14T18:28:48.835937Z", "id": "CVE-2023-22655", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-28T18:17:37.653Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00960.html", "name": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00960.html", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20240405-0006/", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/05/msg00003.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:13:49.758Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-22655", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-03-14T18:28:48.835937Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:intel:3rd_gen_intel_xeon_scalable_processor_family:*:*:*:*:*:*:*:*"], "vendor": "intel", "product": "3rd_gen_intel_xeon_scalable_processor_family", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:intel:xeon_d_processor:*:*:*:*:*:*:*:*"], "vendor": "intel", "product": "xeon_d_processor", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:intel:4th_generation_intel_xeon_platinum_processors:*:*:*:*:*:*:*:*"], "vendor": "intel", "product": "4th_generation_intel_xeon_platinum_processors", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:intel:4th_generation_intel_xeon_gold_processors:*:*:*:*:*:*:*:*"], "vendor": "intel", "product": "4th_generation_intel_xeon_gold_processors", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:intel:4th_gen_intel_xeon_scalable_processors:*:*:*:*:*:*:*:*"], "vendor": "intel", "product": "4th_gen_intel_xeon_scalable_processors", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:intel:4th_gen_intel_xeon_platinum_processors:*:*:*:*:*:*:*:*"], "vendor": "intel", "product": "4th_gen_intel_xeon_platinum_processors", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:intel:4th_gen_intel_xeon_gold_processors:*:*:*:*:*:*:*:*"], "vendor": "intel", "product": "4th_gen_intel_xeon_gold_processors", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:intel:4th_gen_intel_xeon_silver_processors:*:*:*:*:*:*:*:*"], "vendor": "intel", "product": "4th_gen_intel_xeon_silver_processors", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:intel:4th_gen_intel_xeon_bronze_processors:*:*:*:*:*:*:*:*"], "vendor": "intel", "product": "4th_gen_intel_xeon_bronze_processors", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:intel:xeon_cpu_max_series_processors:*:*:*:*:*:*:*:*"], "vendor": "intel", "product": "xeon_cpu_max_series_processors", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:intel:4th_gen_intel_xeon_scalable_processors_with_intel_vran:*:*:*:*:*:*:*:*"], "vendor": "intel", "product": "4th_gen_intel_xeon_scalable_processors_with_intel_vran", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-28T18:17:31.504Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "n/a", "product": "3rd and 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Intel(R) TDX", "versions": [{"status": "affected", "version": "See references"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00960.html", "name": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00960.html"}, {"url": "https://security.netapp.com/advisory/ntap-20240405-0006/"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/05/msg00003.html"}], "descriptions": [{"lang": "en", "value": "Protection mechanism failure in some 3rd and 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege via local access."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "escalation of privilege"}, {"lang": "en", "type": "CWE", "cweId": "CWE-693", "description": "Protection mechanism failure"}]}], "providerMetadata": {"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce", "shortName": "intel", "dateUpdated": "2024-03-14T16:45:46.683Z"}}}, "cveMetadata": {"cveId": "CVE-2023-22655", "state": "PUBLISHED", "dateUpdated": "2024-08-28T18:17:37.653Z", "dateReserved": "2023-01-27T04:00:04.248Z", "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce", "datePublished": "2024-03-14T16:45:46.683Z", "assignerShortName": "intel"}, "dataVersion": "5.1"}

{"affected_release": [{"advisory": "RHSA-2024:9401", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "microcode_ctl-4:20240910-1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}], "bugzilla": {"description": "kernel: local privilege escalation on Intel microcode on Intel(R) Xeon(R)", "id": "2270698", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2270698"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N", "status": "verified"}, "cwe": "CWE-693", "details": ["Protection mechanism failure in some 3rd and 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege via local access.", "A vulnerability was found in the Intel Xeon Processor's microcode. This issue may allow a malicious actor to achieve local privilege escalation when using Intel SGX or Intel TDX features."], "name": "CVE-2023-22655", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "microcode_ctl", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "microcode_ctl", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "microcode_ctl", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-03-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-22655\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-22655\nhttps://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00960.html"], "threat_severity": "Moderate"}