RHBA-2022:8351

Vulnerability from csaf_redhat - Published: 2022-11-15 10:28 - Updated: 2025-12-09 21:01
Summary
Red Hat Bug Fix Advisory: microcode_ctl bug fix and enhancement update

Notes

Topic
An update for microcode_ctl is now available for Red Hat Enterprise Linux 9.
Details
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes linked from the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for microcode_ctl is now available for Red Hat Enterprise Linux 9.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes linked from the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHBA-2022:8351",
        "url": "https://access.redhat.com/errata/RHBA-2022:8351"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/index",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/index"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhba-2022_8351.json"
      }
    ],
    "title": "Red Hat Bug Fix Advisory: microcode_ctl bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2025-12-09T21:01:29+00:00",
      "generator": {
        "date": "2025-12-09T21:01:29+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.13"
        }
      },
      "id": "RHBA-2022:8351",
      "initial_release_date": "2022-11-15T10:28:47+00:00",
      "revision_history": [
        {
          "date": "2022-11-15T10:28:47+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2022-11-15T10:28:47+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-12-09T21:01:29+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS (v. 9)",
                  "product_id": "BaseOS-9.1.0.GA",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:9::baseos"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "microcode_ctl-4:20220809-1.el9.src",
                "product": {
                  "name": "microcode_ctl-4:20220809-1.el9.src",
                  "product_id": "microcode_ctl-4:20220809-1.el9.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/microcode_ctl@20220809-1.el9?arch=src\u0026epoch=4"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "microcode_ctl-4:20220809-1.el9.noarch",
                "product": {
                  "name": "microcode_ctl-4:20220809-1.el9.noarch",
                  "product_id": "microcode_ctl-4:20220809-1.el9.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/microcode_ctl@20220809-1.el9?arch=noarch\u0026epoch=4"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "microcode_ctl-4:20220809-1.el9.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.GA:microcode_ctl-4:20220809-1.el9.noarch"
        },
        "product_reference": "microcode_ctl-4:20220809-1.el9.noarch",
        "relates_to_product_reference": "BaseOS-9.1.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "microcode_ctl-4:20220809-1.el9.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.1.0.GA:microcode_ctl-4:20220809-1.el9.src"
        },
        "product_reference": "microcode_ctl-4:20220809-1.el9.src",
        "relates_to_product_reference": "BaseOS-9.1.0.GA"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Intel"
          ]
        }
      ],
      "cve": "CVE-2022-0005",
      "cwe": {
        "id": "CWE-276",
        "name": "Incorrect Default Permissions"
      },
      "discovery_date": "2022-05-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2086738"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in hw. Sensitive information accessible by physical probing of the JTAG interface for some Intel(R) Processors with SGX may allow an unprivileged user to disclose information via physical access.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "hw: cpu: information disclosure via Intel Software Guard Extensions (SGX) Platform",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has very limited to no visibility and control over binary blobs provided by third-party vendors. Red Hat relies heavily on the vendors to provide timely updates and information about included changes for this content and in most cases merely acts as a release vehicle between the third-party vendor and Red Hat customers with no possibility of influencing or even documenting the changes. Unless explicitly stated, the level of insight, oversight, and control Red Hat has does not meet the criteria required (in terms of Red Hat ownership of development processes, QA, and documentation) for releasing this content as RHSA. For more information please contact the binary content vendor.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-9.1.0.GA:microcode_ctl-4:20220809-1.el9.noarch",
          "BaseOS-9.1.0.GA:microcode_ctl-4:20220809-1.el9.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-0005"
        },
        {
          "category": "external",
          "summary": "RHBZ#2086738",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2086738"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-0005",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-0005"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-0005",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0005"
        },
        {
          "category": "external",
          "summary": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00614.html",
          "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00614.html"
        }
      ],
      "release_date": "2022-05-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-11-15T10:28:47+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-9.1.0.GA:microcode_ctl-4:20220809-1.el9.noarch",
            "BaseOS-9.1.0.GA:microcode_ctl-4:20220809-1.el9.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2022:8351"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation baser or stability.",
          "product_ids": [
            "BaseOS-9.1.0.GA:microcode_ctl-4:20220809-1.el9.noarch",
            "BaseOS-9.1.0.GA:microcode_ctl-4:20220809-1.el9.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "BaseOS-9.1.0.GA:microcode_ctl-4:20220809-1.el9.noarch",
            "BaseOS-9.1.0.GA:microcode_ctl-4:20220809-1.el9.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "hw: cpu: information disclosure via Intel Software Guard Extensions (SGX) Platform"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Intel"
          ]
        }
      ],
      "cve": "CVE-2022-21136",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2022-05-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2086735"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in hw. Improper input validation for some Intel(R) Xeon(R) processors may allow a privileged user to enable a denial of service via local access.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "hw: cpu: denial of service in some Intel Xeon processors",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has very limited to no visibility and control over binary blobs provided by third-party vendors. Red Hat relies heavily on the vendors to provide timely updates and information about included changes for this content and in most cases merely acts as a release vehicle between the third-party vendor and Red Hat customers with no possibility of influencing or even documenting the changes. Unless explicitly stated, the level of insight, oversight, and control Red Hat has does not meet the criteria required (in terms of Red Hat ownership of development processes, QA, and documentation) for releasing this content as RHSA. For more information please contact the binary content vendor.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-9.1.0.GA:microcode_ctl-4:20220809-1.el9.noarch",
          "BaseOS-9.1.0.GA:microcode_ctl-4:20220809-1.el9.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-21136"
        },
        {
          "category": "external",
          "summary": "RHBZ#2086735",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2086735"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-21136",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-21136"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-21136",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21136"
        },
        {
          "category": "external",
          "summary": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00616.html",
          "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00616.html"
        }
      ],
      "release_date": "2022-05-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-11-15T10:28:47+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-9.1.0.GA:microcode_ctl-4:20220809-1.el9.noarch",
            "BaseOS-9.1.0.GA:microcode_ctl-4:20220809-1.el9.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2022:8351"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation baser, or stability.",
          "product_ids": [
            "BaseOS-9.1.0.GA:microcode_ctl-4:20220809-1.el9.noarch",
            "BaseOS-9.1.0.GA:microcode_ctl-4:20220809-1.el9.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "BaseOS-9.1.0.GA:microcode_ctl-4:20220809-1.el9.noarch",
            "BaseOS-9.1.0.GA:microcode_ctl-4:20220809-1.el9.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "hw: cpu: denial of service in some Intel Xeon processors"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Intel"
          ]
        }
      ],
      "cve": "CVE-2022-21151",
      "cwe": {
        "id": "CWE-212",
        "name": "Improper Removal of Sensitive Information Before Storage or Transfer"
      },
      "discovery_date": "2022-05-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2086730"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in hw. Processor optimization removal or modification of security-critical code for some Intel(R) processors may potentially allow an authenticated user to enable information disclosure via local access.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "hw: cpu: information disclosure in certain Intel processors",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has very limited to no visibility and control over binary blobs provided by third-party vendors. Red Hat relies heavily on the vendors to provide timely updates and information about included changes for this content and in most cases merely acts as a release vehicle between the third-party vendor and Red Hat customers with no possibility of influencing or even documenting the changes. Unless explicitly stated, the level of insight, oversight, and control Red Hat has does not meet the criteria required (in terms of Red Hat ownership of development processes, QA, and documentation) for releasing this content as RHSA. For more information please contact the binary content vendor.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-9.1.0.GA:microcode_ctl-4:20220809-1.el9.noarch",
          "BaseOS-9.1.0.GA:microcode_ctl-4:20220809-1.el9.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-21151"
        },
        {
          "category": "external",
          "summary": "RHBZ#2086730",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2086730"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-21151",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-21151"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-21151",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21151"
        },
        {
          "category": "external",
          "summary": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00617.html",
          "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00617.html"
        }
      ],
      "release_date": "2022-05-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-11-15T10:28:47+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-9.1.0.GA:microcode_ctl-4:20220809-1.el9.noarch",
            "BaseOS-9.1.0.GA:microcode_ctl-4:20220809-1.el9.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2022:8351"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation baser, or stability.",
          "product_ids": [
            "BaseOS-9.1.0.GA:microcode_ctl-4:20220809-1.el9.noarch",
            "BaseOS-9.1.0.GA:microcode_ctl-4:20220809-1.el9.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "BaseOS-9.1.0.GA:microcode_ctl-4:20220809-1.el9.noarch",
            "BaseOS-9.1.0.GA:microcode_ctl-4:20220809-1.el9.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "hw: cpu: information disclosure in certain Intel processors"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Intel"
          ]
        }
      ],
      "cve": "CVE-2022-21166",
      "cwe": {
        "id": "CWE-459",
        "name": "Incomplete Cleanup"
      },
      "discovery_date": "2022-05-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2090241"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in hw. Incomplete cleanup in specific special register write operations for some Intel\u00ae Processors may allow an authenticated user to enable information disclosure via local access.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "hw: cpu: incomplete clean-up in specific special register write operations (aka DRPW)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has very limited to no visibility and control over binary blobs provided by third-party vendors. Red Hat relies heavily on the vendors to provide timely updates and information about included changes for this content and in most cases merely acts as a release vehicle between the third-party vendor and Red Hat customers with no possibility of influencing or even documenting the changes. Unless explicitly stated, the level of insight, oversight, and control Red Hat has does not meet the criteria required (in terms of Red Hat ownership of development processes, QA, and documentation) for releasing this content as RHSA. For more information please contact the binary content vendor.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-9.1.0.GA:microcode_ctl-4:20220809-1.el9.noarch",
          "BaseOS-9.1.0.GA:microcode_ctl-4:20220809-1.el9.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-21166"
        },
        {
          "category": "external",
          "summary": "RHBZ#2090241",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2090241"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-21166",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-21166"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-21166",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21166"
        },
        {
          "category": "external",
          "summary": "https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/processor-mmio-stale-data-vulnerabilities.html",
          "url": "https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/processor-mmio-stale-data-vulnerabilities.html"
        }
      ],
      "release_date": "2022-06-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-11-15T10:28:47+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-9.1.0.GA:microcode_ctl-4:20220809-1.el9.noarch",
            "BaseOS-9.1.0.GA:microcode_ctl-4:20220809-1.el9.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2022:8351"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation baser or stability.",
          "product_ids": [
            "BaseOS-9.1.0.GA:microcode_ctl-4:20220809-1.el9.noarch",
            "BaseOS-9.1.0.GA:microcode_ctl-4:20220809-1.el9.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "BaseOS-9.1.0.GA:microcode_ctl-4:20220809-1.el9.noarch",
            "BaseOS-9.1.0.GA:microcode_ctl-4:20220809-1.el9.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "hw: cpu: incomplete clean-up in specific special register write operations (aka DRPW)"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.