CVE-2022-26873

A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages. This can lead to the mitigations bypassing, physical memory contents disclosure, discovery of any secrets from any Virtual Machines (VMs) and bypassing memory isolation and confidential computing boundaries. Additionally, an attacker can build a payload which can be injected into the SMRAM memory. This issue affects: Module name: PlatformInitAdvancedPreMem SHA256: 644044fdb8daea30a7820e0f5f88dbf5cd460af72fbf70418e9d2e47efed8d9b Module GUID: EEEE611D-F78F-4FB9-B868-55907F169280 This issue affects: AMI Aptio 5.x.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.5 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://www.ami.com/security-center/	Vendor Advisory
https://www.binarly.io/advisories/BRLY-2022-027	Exploit Third Party Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00712.html	Not Applicable Third Party Advisory
https://www.ami.com/security-center/	Vendor Advisory
https://www.binarly.io/advisories/BRLY-2022-027	Exploit Third Party Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00712.html	Not Applicable Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:intel:nuc_m15_laptop_kit_lapbc510_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:intel:nuc_m15_laptop_kit_lapbc510:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:intel:nuc_m15_laptop_kit_lapbc710_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:intel:nuc_m15_laptop_kit_lapbc710:-:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:o:ami:aptio_v:5.0:*:*:*:*:*:*:*

History

21 Nov 2024, 06:54

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-09-20 18:15

Updated : 2024-11-21 06:54

NVD link : CVE-2022-26873

Mitre link : CVE-2022-26873

CVE.ORG link : CVE-2022-26873

JSON object : View

Products Affected

intel

nuc_m15_laptop_kit_lapbc510_firmware
nuc_m15_laptop_kit_lapbc510
nuc_m15_laptop_kit_lapbc710
nuc_m15_laptop_kit_lapbc710_firmware

ami

aptio_v

CWE

CWE-121

Stack-based Buffer Overflow

CWE-787

Out-of-bounds Write

{"id": "CVE-2022-26873", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.5}]}, "published": "2022-09-20T18:15:10.087", "references": [{"url": "https://www.ami.com/security-center/", "tags": ["Vendor Advisory"], "source": "cret@cert.org"}, {"url": "https://www.binarly.io/advisories/BRLY-2022-027", "tags": ["Exploit", "Third Party Advisory"], "source": "cret@cert.org"}, {"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00712.html", "tags": ["Not Applicable", "Third Party Advisory"], "source": "cret@cert.org"}, {"url": "https://www.ami.com/security-center/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.binarly.io/advisories/BRLY-2022-027", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00712.html", "tags": ["Not Applicable", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cret@cert.org", "description": [{"lang": "en", "value": "CWE-121"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages. This can lead to the mitigations bypassing, physical memory contents disclosure, discovery of any secrets from any Virtual Machines (VMs) and bypassing memory isolation and confidential computing boundaries. Additionally, an attacker can build a payload which can be injected into the SMRAM memory. This issue affects: Module name: PlatformInitAdvancedPreMem SHA256: 644044fdb8daea30a7820e0f5f88dbf5cd460af72fbf70418e9d2e47efed8d9b Module GUID: EEEE611D-F78F-4FB9-B868-55907F169280 This issue affects: AMI Aptio 5.x."}, {"lang": "es", "value": "Un atacante potencial puede ejecutar un c\u00f3digo arbitrario en el momento de la fase PEI e influir en las etapas de arranque posteriores. Esto puede conllevar a una omisi\u00f3n de las mitigaciones, revelaci\u00f3n del contenido de la memoria f\u00edsica, detecci\u00f3n de cualquier secreto de cualquier m\u00e1quina virtual (VM) y omisi\u00f3n del aislamiento de la memoria y de los l\u00edmites inform\u00e1ticos confidenciales. Adem\u00e1s, un atacante puede construir una carga \u00fatil que puede ser inyectada en la memoria SMRAM. Este problema afecta: Nombre del m\u00f3dulo: PlatformInitAdvancedPreMem SHA256: 644044fdb8daea30a7820e0f5f88dbf5cd460af72fbf70418e9d2e47efed8d9b GUID del m\u00f3dulo: EEEE611D-F78F-4FB9-B868-55907F169280 Este problema afecta a: AMI Aptio versi\u00f3n 5.x"}], "lastModified": "2024-11-21T06:54:43.483", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:intel:nuc_m15_laptop_kit_lapbc510_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "393326E2-AF17-45EE-A709-2E439F3D0A1A"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:intel:nuc_m15_laptop_kit_lapbc510:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "29817A9E-9FDE-421B-950A-4053F9D22FD1"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:intel:nuc_m15_laptop_kit_lapbc710_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7E885560-7FA9-43E6-A059-B7CD9BC3A1FA"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:intel:nuc_m15_laptop_kit_lapbc710:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7074EC4C-7096-47D1-9CA8-9C4784DBF72D"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ami:aptio_v:5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FD2A25A0-0CFC-4A63-A7A9-4CD4D2A90FAD"}], "operator": "OR"}]}], "sourceIdentifier": "cret@cert.org"}