CVE-2022-32231 [High] | Security Vulnerability in Xeon Gold 6138p Firmware

CVE-2022-32231 is rated Low Risk (35.2/100): CVSS High severity, with low exploitation likelihood (EPSS 0.06%). Monitor for updates and reassess as exploit intelligence or EPSS changes.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2025-03-30	0.04%	0.06%	+0.02%
2	2025-03-29	0.06%	0.04%	-0.02%
3	2025-03-17	—	0.06%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2025-03-30

0.04%

0.06%

+0.02%

2025-03-29

0.06%

0.04%

-0.02%

2025-03-17

—

0.06%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
7.5	3.1	HIGH	`CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H` Click to expand Attack vector (AV:L) They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by. Attack complexity (AC:H) Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work. Privileges required (PR:H) They need powerful rights—admin, root, or similar—before this pays off. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:C) Breaking this can reach past the original component and bite other resources—bigger blast radius. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	0.8	6.0	[email protected]
6.7	3.1	MEDIUM	`CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H` Click to expand Attack vector (AV:L) They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:H) They need powerful rights—admin, root, or similar—before this pays off. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	0.8	5.9	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

7.5

3.1

HIGH

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Click to expand

Attack vector (AV:L): They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:H): Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:H): They need powerful rights—admin, root, or similar—before this pays off.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:C): Breaking this can reach past the original component and bite other resources—bigger blast radius.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:H): They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

0.8

6.0

[email protected]

6.7

3.1

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Click to expand

Attack vector (AV:L): They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:H): They need powerful rights—admin, root, or similar—before this pays off.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:H): They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

0.8

5.9

[email protected]

OS Trackers for CVE-2022-32231

vendor	priority	summary	link
`redhat`	high	—	https://access.redhat.com/security/cve/CVE-2022-32231

vendor

priority

summary

link

redhat

high

—

https://access.redhat.com/security/cve/CVE-2022-32231

Affected software / configurations for CVE-2022-32231

Vendor	Product	Version	Raw CPE
intel	xeon_gold_6138p_firmware	—	cpe:2.3:o:intel:xeon_gold_6138p_firmware:-:::::::*
intel	xeon_bronze_3104_firmware	—	cpe:2.3:o:intel:xeon_bronze_3104_firmware:-:::::::*
intel	xeon_bronze_3106_firmware	—	cpe:2.3:o:intel:xeon_bronze_3106_firmware:-:::::::*
intel	xeon_gold_5115_firmware	—	cpe:2.3:o:intel:xeon_gold_5115_firmware:-:::::::*
intel	xeon_gold_5118_firmware	—	cpe:2.3:o:intel:xeon_gold_5118_firmware:-:::::::*
intel	xeon_gold_5119t_firmware	—	cpe:2.3:o:intel:xeon_gold_5119t_firmware:-:::::::*
intel	xeon_gold_5120_firmware	—	cpe:2.3:o:intel:xeon_gold_5120_firmware:-:::::::*
intel	xeon_gold_5120t_firmware	—	cpe:2.3:o:intel:xeon_gold_5120t_firmware:-:::::::*
intel	xeon_gold_5122_firmware	—	cpe:2.3:o:intel:xeon_gold_5122_firmware:-:::::::*
intel	xeon_gold_6126_firmware	—	cpe:2.3:o:intel:xeon_gold_6126_firmware:-:::::::*
intel	xeon_gold_6126f_firmware	—	cpe:2.3:o:intel:xeon_gold_6126f_firmware:-:::::::*
intel	xeon_gold_6126t_firmware	—	cpe:2.3:o:intel:xeon_gold_6126t_firmware:-:::::::*
intel	xeon_gold_6128_firmware	—	cpe:2.3:o:intel:xeon_gold_6128_firmware:-:::::::*
intel	xeon_gold_6130_firmware	—	cpe:2.3:o:intel:xeon_gold_6130_firmware:-:::::::*
intel	xeon_gold_6130f_firmware	—	cpe:2.3:o:intel:xeon_gold_6130f_firmware:-:::::::*
intel	xeon_gold_6130t_firmware	—	cpe:2.3:o:intel:xeon_gold_6130t_firmware:-:::::::*
intel	xeon_gold_6132_firmware	—	cpe:2.3:o:intel:xeon_gold_6132_firmware:-:::::::*
intel	xeon_gold_6134_firmware	—	cpe:2.3:o:intel:xeon_gold_6134_firmware:-:::::::*
intel	xeon_gold_6136_firmware	—	cpe:2.3:o:intel:xeon_gold_6136_firmware:-:::::::*
intel	xeon_gold_6138_firmware	—	cpe:2.3:o:intel:xeon_gold_6138_firmware:-:::::::*
intel	xeon_gold_6138f_firmware	—	cpe:2.3:o:intel:xeon_gold_6138f_firmware:-:::::::*
intel	xeon_gold_6138t_firmware	—	cpe:2.3:o:intel:xeon_gold_6138t_firmware:-:::::::*
intel	xeon_gold_6140_firmware	—	cpe:2.3:o:intel:xeon_gold_6140_firmware:-:::::::*
intel	xeon_gold_6142_firmware	—	cpe:2.3:o:intel:xeon_gold_6142_firmware:-:::::::*
intel	xeon_gold_6142f_firmware	—	cpe:2.3:o:intel:xeon_gold_6142f_firmware:-:::::::*
intel	xeon_gold_6144_firmware	—	cpe:2.3:o:intel:xeon_gold_6144_firmware:-:::::::*
intel	xeon_gold_6146_firmware	—	cpe:2.3:o:intel:xeon_gold_6146_firmware:-:::::::*
intel	xeon_gold_6148_firmware	—	cpe:2.3:o:intel:xeon_gold_6148_firmware:-:::::::*
intel	xeon_gold_6148f_firmware	—	cpe:2.3:o:intel:xeon_gold_6148f_firmware:-:::::::*
intel	xeon_gold_6150_firmware	—	cpe:2.3:o:intel:xeon_gold_6150_firmware:-:::::::*
intel	xeon_gold_6152_firmware	—	cpe:2.3:o:intel:xeon_gold_6152_firmware:-:::::::*
intel	xeon_gold_6154_firmware	—	cpe:2.3:o:intel:xeon_gold_6154_firmware:-:::::::*
intel	xeon_platinum_8153_firmware	—	cpe:2.3:o:intel:xeon_platinum_8153_firmware:-:::::::*
intel	xeon_platinum_8156_firmware	—	cpe:2.3:o:intel:xeon_platinum_8156_firmware:-:::::::*
intel	xeon_platinum_8158_firmware	—	cpe:2.3:o:intel:xeon_platinum_8158_firmware:-:::::::*
intel	xeon_platinum_8160_firmware	—	cpe:2.3:o:intel:xeon_platinum_8160_firmware:-:::::::*
intel	xeon_platinum_8160f_firmware	—	cpe:2.3:o:intel:xeon_platinum_8160f_firmware:-:::::::*
intel	xeon_platinum_8160t_firmware	—	cpe:2.3:o:intel:xeon_platinum_8160t_firmware:-:::::::*
intel	xeon_platinum_8164_firmware	—	cpe:2.3:o:intel:xeon_platinum_8164_firmware:-:::::::*
intel	xeon_platinum_8168_firmware	—	cpe:2.3:o:intel:xeon_platinum_8168_firmware:-:::::::*
intel	xeon_platinum_8170_firmware	—	cpe:2.3:o:intel:xeon_platinum_8170_firmware:-:::::::*
intel	xeon_platinum_8176_firmware	—	cpe:2.3:o:intel:xeon_platinum_8176_firmware:-:::::::*
intel	xeon_platinum_8176f_firmware	—	cpe:2.3:o:intel:xeon_platinum_8176f_firmware:-:::::::*
intel	xeon_platinum_8180_firmware	—	cpe:2.3:o:intel:xeon_platinum_8180_firmware:-:::::::*
intel	xeon_silver_4108_firmware	—	cpe:2.3:o:intel:xeon_silver_4108_firmware:-:::::::*
intel	xeon_silver_4109t_firmware	—	cpe:2.3:o:intel:xeon_silver_4109t_firmware:-:::::::*
intel	xeon_silver_4110_firmware	—	cpe:2.3:o:intel:xeon_silver_4110_firmware:-:::::::*
intel	xeon_silver_4112_firmware	—	cpe:2.3:o:intel:xeon_silver_4112_firmware:-:::::::*
intel	xeon_silver_4114_firmware	—	cpe:2.3:o:intel:xeon_silver_4114_firmware:-:::::::*
intel	xeon_silver_4114t_firmware	—	cpe:2.3:o:intel:xeon_silver_4114t_firmware:-:::::::*
intel	xeon_silver_4116_firmware	—	cpe:2.3:o:intel:xeon_silver_4116_firmware:-:::::::*
intel	xeon_silver_4116t_firmware	—	cpe:2.3:o:intel:xeon_silver_4116t_firmware:-:::::::*
intel	xeon_gold_5315y_firmware	—	cpe:2.3:o:intel:xeon_gold_5315y_firmware:-:::::::*
intel	xeon_gold_5317_firmware	—	cpe:2.3:o:intel:xeon_gold_5317_firmware:-:::::::*
intel	xeon_gold_5318n_firmware	—	cpe:2.3:o:intel:xeon_gold_5318n_firmware:-:::::::*
intel	xeon_gold_5318s_firmware	—	cpe:2.3:o:intel:xeon_gold_5318s_firmware:-:::::::*
intel	xeon_gold_5318y_firmware	—	cpe:2.3:o:intel:xeon_gold_5318y_firmware:-:::::::*
intel	xeon_gold_5320_firmware	—	cpe:2.3:o:intel:xeon_gold_5320_firmware:-:::::::*
intel	xeon_gold_5320t_firmware	—	cpe:2.3:o:intel:xeon_gold_5320t_firmware:-:::::::*
intel	xeon_gold_6312u_firmware	—	cpe:2.3:o:intel:xeon_gold_6312u_firmware:-:::::::*
intel	xeon_gold_6314u_firmware	—	cpe:2.3:o:intel:xeon_gold_6314u_firmware:-:::::::*
intel	xeon_gold_6326_firmware	—	cpe:2.3:o:intel:xeon_gold_6326_firmware:-:::::::*
intel	xeon_gold_6330_firmware	—	cpe:2.3:o:intel:xeon_gold_6330_firmware:-:::::::*
intel	xeon_gold_6330n_firmware	—	cpe:2.3:o:intel:xeon_gold_6330n_firmware:-:::::::*
intel	xeon_gold_6334_firmware	—	cpe:2.3:o:intel:xeon_gold_6334_firmware:-:::::::*
intel	xeon_gold_6336y_firmware	—	cpe:2.3:o:intel:xeon_gold_6336y_firmware:-:::::::*
intel	xeon_gold_6338_firmware	—	cpe:2.3:o:intel:xeon_gold_6338_firmware:-:::::::*
intel	xeon_gold_6338n_firmware	—	cpe:2.3:o:intel:xeon_gold_6338n_firmware:-:::::::*
intel	xeon_gold_6338t_firmware	—	cpe:2.3:o:intel:xeon_gold_6338t_firmware:-:::::::*
intel	xeon_gold_6342_firmware	—	cpe:2.3:o:intel:xeon_gold_6342_firmware:-:::::::*
intel	xeon_gold_6346_firmware	—	cpe:2.3:o:intel:xeon_gold_6346_firmware:-:::::::*
intel	xeon_gold_6348_firmware	—	cpe:2.3:o:intel:xeon_gold_6348_firmware:-:::::::*
intel	xeon_gold_6354_firmware	—	cpe:2.3:o:intel:xeon_gold_6354_firmware:-:::::::*
intel	xeon_platinum_8351n_firmware	—	cpe:2.3:o:intel:xeon_platinum_8351n_firmware:-:::::::*
intel	xeon_platinum_8352m_firmware	—	cpe:2.3:o:intel:xeon_platinum_8352m_firmware:-:::::::*
intel	xeon_platinum_8352s_firmware	—	cpe:2.3:o:intel:xeon_platinum_8352s_firmware:-:::::::*
intel	xeon_platinum_8352v_firmware	—	cpe:2.3:o:intel:xeon_platinum_8352v_firmware:-:::::::*
intel	xeon_platinum_8352y_firmware	—	cpe:2.3:o:intel:xeon_platinum_8352y_firmware:-:::::::*
intel	xeon_platinum_8358_firmware	—	cpe:2.3:o:intel:xeon_platinum_8358_firmware:-:::::::*
intel	xeon_platinum_8358p_firmware	—	cpe:2.3:o:intel:xeon_platinum_8358p_firmware:-:::::::*

References for CVE-2022-32231

URL	Tags
http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00717.html	Vendor Advisory

URL

CVE-2022-32231

Exploit prediction scoring system (EPSS) score for CVE-2022-32231

Common vulnerability scoring system (CVSS) metrics for CVE-2022-32231

Weakness enumeration for CVE-2022-32231

OS Trackers for CVE-2022-32231

Affected software / configurations for CVE-2022-32231

References for CVE-2022-32231