Intel Server Platform Services (SPS) firmware: Active debug code left enabled in shipped SPS firmware lets

CVSS 8.8CVE-2022-36348Firmware, BMC & network fabriccurated

Impact

Active debug code left enabled in shipped SPS firmware lets an authenticated user escalate privilege. SPS is the server variant of the management engine - it is the component running on your Xeon nodes, not the consumer CSME - so debug code in production firmware is squarely a datacenter problem.

Who can reach it

Authenticated local access on an affected server.

What to do

Fixed in Intel SPS firmware, which reaches you as an OEM BIOS or firmware package - not as a microcode or OS update. That means: wait for your server vendor to ship it, drain the node, flash, and reboot. OEM availability is the long pole and routinely lags the Intel advisory by one or more quarters on server platforms. Track it per platform SKU, because vendors ship these unevenly across their own product lines.

References

https://nvd.nist.gov/vuln/detail/CVE-2022-36348 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00718.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.