Unauthorized Error Injection in Intel Microcode: CVE-2022-41804
Summary
UBUNTU-CVE-2022-41804: Unauthorized error injection in Intel(R) SGX or Intel(R) TDX for some Intel(R) Xeon(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access. Affects intel-microcode versions 1.20130906.1ubuntu2 – 3.20210608.0ubuntu0.14.04.1+esm1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Intel Microcode is a critical component that updates the internal instructions of Intel processors, enhancing performance and security. It plays a vital role in ensuring the stability and security of systems running Intel hardware. However, certain versions of Intel Microcode are vulnerable to unauthorized error injection, which can lead to severe security risks.
Vulnerability Detail
The vulnerability, identified as CVE-2022-41804, arises from unauthorized error injection in Intel's Software Guard Extensions (SGX) or Trusted Execution Technology (TDX) for specific Intel Xeon processors. This flaw allows a privileged user to potentially escalate privileges via local access, posing a significant security threat. The vulnerability has a CVSS score of 6.7, indicating a medium severity level, and can lead to unauthorized access and manipulation of sensitive data.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can limit access to the affected systems and monitor for any unusual activity. It is advisable to restrict local access to systems running vulnerable versions of Intel Microcode until the package is updated.
Conclusion
CVE-2022-41804 is a significant vulnerability in Intel Microcode that can lead to privilege escalation through unauthorized error injection. Users are strongly advised to update their systems to the latest patched versions to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for intel-microcode →
FAQ
CVE-2022-41804 is a vulnerability in Intel Microcode that allows unauthorized error injection, potentially leading to privilege escalation.
Affected versions include intel-microcode 3.20210608.0ubuntu0.14.04.1+esm1, 3.20230808.0ubuntu0.16.04.1+esm1, 3.20230808.0ubuntu0.18.04.1+esm1, and others listed in the vulnerability details.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to unauthorized access and manipulation of sensitive data, allowing a privileged user to escalate their privileges.
No subscription is required for the patched versions of Intel Microcode available for Ubuntu 20.04, 22.04, and 24.04.
Related vulnerabilities
Recent vulnerabilities recorded for intel-microcode.
