CVE-2022-21233

Public on 2022-08-18
Modified on 2022-09-01
Description
A flaw was found in hw. The APIC can operate in xAPIC mode (also known as a legacy mode), in which APIC configuration registers are exposed through a memory-mapped I/O (MMIO) page. This flaw allows an attacker who can execute code on a target CPU to query the APIC configuration page. When reading the APIC configuration page with an unaligned read from the MMIO page, the registers may return stale data from previous requests made by the same processor core to the same configuration page, leading to unauthorized access.
Severity
Medium severity
Medium
CVSS v3 Base Score
6.0
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Core microcode_ctl 2022-09-01 ALAS2-2022-1842 Fixed
Amazon Linux 2023 microcode_ctl 2023-02-17 ALAS2023-2023-055 Fixed

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 6.0 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
NVD CVSSv3 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N