CVE-2022-21136

Improper input validation for some Intel(R) Xeon(R) Processors may allow a privileged user to...

5.5 MediumFix available

Improper input validation for some Intel(R) Xeon(R) Processors may allow a privileged user to potentially enable denial of service via local access.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.27%Down 0.6 points since May 13, 2022

What each source reports

NVD Score used 5.5

Improper input validation for some Intel(R) Xeon(R) Processors may allow a privileged user to potentially enable denial of service via local access.

Record: CVE-2022-21136
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 4.9 MediumAV:L/AC:L/Au:N/C:N/I:N/A:C
Weakness: CWE-20
Updated: 2026-11-02

CVE List 5.5

Improper input validation for some Intel(R) Xeon(R) Processors may allow a privileged user to potentially enable denial of service via local access.

Record: CVE-2022-21136
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-20
Updated: 2026-11-02

EUVDEUVD-2022-26383 5.5

Improper input validation for some Intel(R) Xeon(R) Processors may allow a privileged user to potentially enable denial of service via local access.

Record: EUVD-2022-26383
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-3xg3-qffw-vc65 5.5

Improper input validation for some Intel(R) Xeon(R) Processors may allow a privileged user to...

Improper input validation for some Intel(R) Xeon(R) Processors may allow a privileged user to potentially enable denial of service via local access.

Record: GHSA-3xg3-qffw-vc65
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-20
Updated: 2026-11-02

OSVRHBA-2022:8351 5.5

Red Hat Bug Fix Advisory: microcode_ctl bug fix and enhancement update

Record: RHBA-2022:8351
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVMGASA-2022-0193 No score

Updated microcode packages fix security vulnerabilities

Updated microcodes for Intel processors, fixing various functional issues, and at least the following security issues:

Sensitive information accessible by physical probing of JTAG interface for some Intel(R) Processors with SGX may allow an unprivileged user to potentially enable information disclosure via physical access (CVE-2022-0005).

Description: Improper access control for some Intel(R) Xeon(R) Processors may allow an authenticated user to potentially enable information disclosure via local access (CVE-2022-21131).

Improper input validation for some Intel(R) Xeon(R) Processors may allow a privileged user to potentially enable denial of service via local access (CVE-2022-21136).

Processor optimization removal or modification of security-critical code for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access (CVE-2022-21151).

For info about the other fixes in this update, see the github reference.

Record: MGASA-2022-0193
Updated: 2026-11-02

Affected products

Show 134 moreShow less

Affected packages

Affected packages
Package	Affected	Fixed
`microcode` Mageia:8	before 0.20220510-1.mga8.nonfree	0.20220510-1.mga8.nonfree
`microcode_ctl` Red Hat:enterprise_linux:9::baseos	before 4:20220809-1.el9	4:20220809-1.el9

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-21136 is a medium vulnerability (CVSS 5.5) in Intel Core I9-7900x Firmware, published May 12, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 19th percentile. Fixed in microcode 0.20220510-1.mga8.nonfree.

References

Show 21 moreShow less