CVE-2022-38087 Information disclosure in Intel(R) Processors

Medium 4.1 Published 10 May 2023 Updated 13 Feb 2025

A privileged local user can exploit a BIOS firmware flaw in Intel processors to access sensitive information.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-38087?

CVE-2022-38087 is a medium-severity vulnerability in Intel(R) Processors, published on 10 May 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Exposure of resource to wrong sphere in BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.

Weakness: CWE-668

Which versions are affected by CVE-2022-38087?

It affects 467 products.

Products include Intel Core I3-1000g1 Firmware, Intel Core I3-1000g4 Firmware, Intel Core I3-1005g1 Firmware, Intel Core I3-10100 Firmware, Intel Core I3-10100e Firmware, Intel Core I3-10100f Firmware and 461 more.

How do I fix CVE-2022-38087?

No fix has been published for CVE-2022-38087 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-38087 being exploited?

There is no known exploitation of CVE-2022-38087 in the wild and no public exploit code.

Sources

Also known as GHSA-7whc-54gw-fxfm.