What’s Vulnerable › Vulnerabilities
CVE-2022-21166
- Severity: medium (CVSS 5.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 6.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2022-06-15 · updated 2026-10-14
- Weakness: CWE-459
Description
Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
Affected products
- Debian Linux: 9.0, 10.0, 11.0 (and their updates)
- Fedoraproject Fedora: 35, 36 (and their updates)
- Intel(R) SGX DCAP software for Windows: before 1.14.100.3 — fixed in 1.14.100.3
- Intel Sgx Psw: before 2.16.100.3; before 2.17.100.3 — fixed in 2.16.100.3, 2.17.100.3
- Intel(R) SGX SDK software: before 2.16.100.3; before 2.17.100.3 — fixed in 2.16.100.3, 2.17.100.3
- VMware ESXi: 7.0-beta, 7.0-update_1, 7.0-update_1a, 7.0-update_1b, 7.0-update_1c, 7.0-update_1d (+6); 7.0
- xen: all versions
- Intel(R) Processors: See references
How to fix
Upgrade to a fixed version: Intel(R) SGX DCAP software for Windows 1.14.100.3; Intel Sgx Psw 2.16.100.3, 2.17.100.3; Intel(R) SGX SDK software 2.16.100.3, 2.17.100.3. Check the vendor advisory for mitigations.
References
- http://www.openwall.com/lists/oss-security/2022/06/16/1
- https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FHTEW3RXU2GW6S3RCPQG4VNCZGI3TOSV/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MCVOMHBQRH4KP7IN6U24CW7F2D2L5KBS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RKRXZ4LHGCGMOG24ZCEJNY6R2BTS4S2Q/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4P2KJYL74KGLHE4JZETVW7PZH6ZIABA/
- https://security.gentoo.org/glsa/202208-23
- https://security.netapp.com/advisory/ntap-20220624-0008/
- https://www.debian.org/security/2022/dsa-5173
- https://www.debian.org/security/2022/dsa-5178
- https://www.debian.org/security/2022/dsa-5184
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00615.html
Get alerted when CVE-2022-21166 or the next vulnerability affects your stack