Processor vulnerability
CVE-2022-0004
A hardware debug mode and the INIT handling of the boot processor could override the locks of Boot Guard and TXT; the fix is a CSME update and settings.
- Name
- Boot Guard and TXT lock override
- Vulnerability
- Intel BIOS, UEFI and SMM
- Kind
- Firmware
- CVE published
- 2022-05-12 CVE record
- Advisories
- INTEL-SA-00613
Boot Guard and Trusted Execution Technology (TXT) depend on locks. On the processors and chipsets below, a hardware debug mode and the processor’s INIT setting could override those locks, so an attacker could escalate privilege. Intel scores it for an unauthenticated attacker with physical access and for an authenticated one on an adjacent network.
Intel’s fix is a CSME update, which adds a setting that clears the bootstrap processor’s INIT bit (DBI) so that an INIT cannot bypass the startup authenticated code module (ACM), together with its earlier advice to disable CPU debug when Boot Guard is on. For the C620A series chipset Intel gives guidance rather than a version.
Affected processors
12 of the 12 microarchitectures listed are affected in all or some of their models.
| Microarchitecture | Status | Detail | Source |
|---|---|---|---|
| Cannon Lake | Affected | 8th generation Core | intel.com |
| Comet Lake | Affected | 10th generation Core | intel.com |
| Ice Lake (client) | Affected | 10th generation Core | intel.com |
| Tiger Lake | Affected | 11th generation Core, Pentium Gold and Celeron 6000 | intel.com |
| Alder Lake | Affected | 12th generation Core | intel.com |
| Rocket Lake | Affected | 11th generation Core and Xeon W-1300 | intel.com |
| Goldmont Plus | Affected | Pentium J5000/N5000, Pentium and Celeron J4000/N4000 | intel.com |
| Tremont | Affected | Atom x6000E and P5000, Pentium Silver and Celeron N, Lakefield | intel.com |
| Kaby Lake | Some models | 8th generation Core (Kaby Lake R, Amber Lake) | intel.com |
| Coffee Lake | Some models | 8th generation Core, Pentium Gold and Celeron 4000 | intel.com |
| Skylake-SP | Some models | Xeon D-2000 | intel.com |
| Goldmont | Some models | Atom E3900 and Celeron J3000/N3000 (Apollo Lake) | intel.com |
Mitigations
- Firmware: An update of the CSME firmware from the system's manufacturer, with the setting that clears the DBI bit so that an INIT cannot bypass the startup ACM. Source.
- Firmware: Disabling CPU debug in the firmware when Boot Guard is enabled, as Intel advised before. Source.
Related CVEs
- CVE-2009-4419 SINIT ACM MCHBAR misconfiguration
- CVE-2011-5174 SINIT ACM buffer overflow
- CVE-2013-5740 SINIT ACM privilege escalation
- CVE-2017-5704 Platform sample code password exposure
- CVE-2018-12201 Reference firmware buffer overflow
- CVE-2018-12202 Reference firmware privilege escalation
- CVE-2018-12203 Reference firmware denial of service
- CVE-2018-12204 Reference firmware improper memory initialization
- CVE-2018-12205 Reference firmware improper certificate validation
- CVE-2019-0119 System firmware buffer overflow
- CVE-2019-0120 Reference firmware insufficient key protection
- CVE-2019-0124 TXT memory protection
- CVE-2019-0126 Reference firmware insufficient access control
- CVE-2019-0151 TXT memory protection
- CVE-2019-0152 SMM and TXT memory protection
- CVE-2019-0184 TXT protected memory access control
- CVE-2019-0185 SMM protected memory access control
- CVE-2019-11136 System firmware insufficient access control
- CVE-2019-11137 System firmware insufficient input validation
- CVE-2019-14556 BIOS improper initialization
- CVE-2019-14557 BIOS buffer overflow
- CVE-2019-14558 BIOS insufficient control flow management
- CVE-2020-0528 BIOS improper buffer restrictions
- CVE-2020-0529 BIOS improper initialization
- CVE-2020-0571 BIOS improper conditions check
- CVE-2020-0587 BIOS improper conditions check
- CVE-2020-0588 BIOS improper conditions check
- CVE-2020-0590 BIOS improper input validation
- CVE-2020-0591 BIOS improper buffer restrictions
- CVE-2020-0592 BIOS out of bounds write
- CVE-2020-0593 BIOS improper buffer restrictions
- CVE-2020-8670 BIOS race condition
- CVE-2020-8671 BIOS insufficient control flow management
- CVE-2020-8672 BIOS out of bound read
- CVE-2020-8700 BIOS improper input validation
- CVE-2020-8738 BIOS sample code improper conditions check
- CVE-2020-8739 BIOS sample code use of potentially dangerous function
- CVE-2020-8740 BIOS sample code out of bounds write
- CVE-2020-8764 BIOS improper access control
- CVE-2020-12357 BIOS improper initialization
- CVE-2020-12358 BIOS out of bounds write
- CVE-2020-12359 BIOS insufficient control flow management
- CVE-2020-12360 BIOS out of bounds read
- CVE-2020-24457 BIOS logic error
- CVE-2020-24486 BIOS improper input validation
- CVE-2021-0091 BIOS improper access control
- CVE-2021-0092 BIOS improper access control
- CVE-2021-0093 BIOS incorrect default permissions
- CVE-2021-0095 BIOS improper initialization
- CVE-2021-0099 BIOS insufficient control flow management
- CVE-2021-0103 BIOS insufficient control flow management
- CVE-2021-0107 BIOS unchecked return value
- CVE-2021-0111 BIOS NULL pointer dereference
- CVE-2021-0114 BIOS unchecked return value
- CVE-2021-0115 BIOS buffer overflow
- CVE-2021-0116 BIOS out-of-bounds write
- CVE-2021-0117 BIOS pointer issues
- CVE-2021-0118 BIOS out-of-bounds read
- CVE-2021-0119 BIOS improper initialization
- CVE-2021-0124 BIOS improper access control
- CVE-2021-0125 BIOS improper initialization
- CVE-2021-0144 BSSA DFT default variable
- CVE-2021-0153 BIOS out-of-bounds write
- CVE-2021-0154 BIOS improper input validation
- CVE-2021-0155 BIOS unchecked return value
- CVE-2021-0156 BIOS improper input validation
- CVE-2021-0157 BIOS insufficient control flow management
- CVE-2021-0158 BIOS improper input validation
- CVE-2021-0159 BIOS ACM improper input validation
- CVE-2021-0187 BIOS improper access control
- CVE-2021-0188 BIOS return of pointer value outside of expected range
- CVE-2021-0189 BIOS use of out-of-range pointer offset
- CVE-2021-0190 BIOS uncaught exception
- CVE-2021-33060 BIOS out-of-bounds write
- CVE-2021-33103 BIOS ACM unintended intermediary
- CVE-2021-33117 3rd generation Xeon Scalable access control
- CVE-2021-33122 BIOS insufficient control flow management
- CVE-2021-33123 BIOS ACM improper access control
- CVE-2021-33124 BIOS ACM out-of-bounds write
- CVE-2022-21198 BIOS time-of-check time-of-use race condition
- CVE-2022-26006 BIOS improper input validation
- CVE-2022-26343 BIOS improper access control
- CVE-2022-26837 BIOS improper input validation
- CVE-2022-27879 BIOS improper buffer restrictions
- CVE-2022-30539 BIOS use after free
- CVE-2022-30704 SINIT ACM improper initialization
- CVE-2022-32231 BIOS improper initialization
- CVE-2022-33894 BIOS improper input validation
- CVE-2022-37343 BIOS improper access control
- CVE-2022-38083 BIOS improper initialization
- CVE-2022-38087 BIOS exposure of resource to wrong sphere
- CVE-2022-43505 BIOS insufficient control flow management
- CVE-2022-44611 BIOS improper input validation
- CVE-2023-22329 BIOS improper input validation
- CVE-2023-22351 UEFI out-of-bounds write
- CVE-2023-23904 UEFI NULL pointer dereference
- CVE-2023-25546 UEFI out-of-bounds read
- CVE-2023-25756 BIOS out-of-bounds read
- CVE-2023-27504 BIOS Guard improper conditions check
- CVE-2023-28383 PPAM improper conditions check
- CVE-2023-28402 BIOS Guard improper input validation
- CVE-2023-32282 BIOS race condition
- CVE-2023-34440 UEFI improper input validation
- CVE-2023-41833 UEFI race condition
- CVE-2023-42772 UEFI untrusted pointer dereference
- CVE-2023-43626 UEFI improper access control
- CVE-2023-43758 UEFI improper input validation
- CVE-2024-21781 UEFI improper input validation
- CVE-2024-21829 UEFI improper input validation
- CVE-2024-21859 UEFI improper buffer restrictions
- CVE-2024-21871 UEFI improper input validation
- CVE-2024-23599 Seamless Firmware Updates race
- CVE-2024-24582 XmlCli input validation
- CVE-2024-24853 SMI Transfer Monitor transition order
- CVE-2024-25565 UEFI insufficient control flow management
- CVE-2024-28047 UEFI improper input validation
- CVE-2024-28127 UEFI improper input validation
- CVE-2024-29214 UEFI improper input validation
- CVE-2024-31155 UEFI improper buffer restrictions
- CVE-2024-31157 UEFI improper initialization
- CVE-2024-39279 UEFI insufficient granularity of access control
- CVE-2025-20004 ACTM control flow on Xeon 6 E-cores
- CVE-2025-20005 UEFI improper buffer restrictions
- CVE-2025-20027 UEFI improper input validation
- CVE-2025-20028 UEFI time-of-check time-of-use race condition
- CVE-2025-20064 UEFI improper input validation
- CVE-2025-20068 UEFI improper input validation
- CVE-2025-20073 UEFI improper buffer restrictions
- CVE-2025-20077 UEFI memory not released
- CVE-2025-20083 Slim Bootloader improper authentication
- CVE-2025-20096 UEFI improper input validation
- CVE-2025-20105 UEFI improper input validation
- CVE-2025-22444 UEFI exposure of resource to wrong sphere
- CVE-2025-22850 UEFI time-of-check time-of-use race condition
- CVE-2025-27560 Platform firmware infinite loop
- CVE-2025-30185 UEFI active debug code
- CVE-2025-35968 Slim Bootloader protection failure
- CVE-2025-35991 UEFI improper initialization
- CVE-2026-20712 UEFI incomplete cleanup
- CVE-2026-20713 Xeon firmware control flow
- CVE-2026-20753 Slim Bootloader integer overflow
- CVE-2026-20898 ACTM access control
- CVE-2026-20901 Xeon firmware input validation
- CVE-2026-25194 Slim Bootloader out-of-bounds write
- CVE-2026-28729 Slim Bootloader integer overflow