SSA-981975: Information Disclosure Vulnerability in Intel-CPUs (CVE-2022-40982) Impacting SIMATIC IPCs
Several Intel-CPU based SIMATIC IPCs are affected by an information exposure vulnerability (CVE-2022-40982) in the CPU that could allow an authenticated local user to potentially read other users' data [1]. The issue is also known as "Gather Data Sampling" (GDS) or Downfall Attacks. For details refer to the chapter "Additional Information". Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available. [1] https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00828.html
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-40982US | medium6.5 | — | ||
Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an authenticated user to po… | ||||
references
External citations — patches, advisories, analysis.
remediations (22)
- MitigationSIMATIC Field PG M6
Ensure that only trusted persons have access to the system and avoid the configuration of additional accounts
- MitigationSIMATIC IPC BX-39A
Ensure that only trusted persons have access to the system and avoid the configuration of additional accounts
- MitigationSIMATIC IPC PX-39A
Ensure that only trusted persons have access to the system and avoid the configuration of additional accounts
- MitigationSIMATIC IPC PX-39A PRO
Ensure that only trusted persons have access to the system and avoid the configuration of additional accounts
- MitigationSIMATIC IPC RW-543A
Ensure that only trusted persons have access to the system and avoid the configuration of additional accounts
- MitigationSIMATIC IPC1047
Ensure that only trusted persons have access to the system and avoid the configuration of additional accounts
- MitigationSIMATIC IPC1047E
Ensure that only trusted persons have access to the system and avoid the configuration of additional accounts
- MitigationSIMATIC IPC627E
Ensure that only trusted persons have access to the system and avoid the configuration of additional accounts
- MitigationSIMATIC IPC647E
Ensure that only trusted persons have access to the system and avoid the configuration of additional accounts
- MitigationSIMATIC IPC677E
Ensure that only trusted persons have access to the system and avoid the configuration of additional accounts
- MitigationSIMATIC IPC847E
Ensure that only trusted persons have access to the system and avoid the configuration of additional accounts
- No fix plannedSIMATIC IPC1047
Currently no fix is planned
- FixedSIMATIC Field PG M6
Update to V26.01.11 or later version
- FixedSIMATIC IPC BX-39A
Update to V29.01.04 or later version
- FixedSIMATIC IPC PX-39A
Update to V29.01.04 or later version
- FixedSIMATIC IPC PX-39A PRO
Update to V29.01.04 or later version
- FixedSIMATIC IPC RW-543A
Update to V1.1.2 or later version
- FixedSIMATIC IPC1047E
Update to V4.2 or later version
- FixedSIMATIC IPC627E
Update to V25.02.14 or later version
- FixedSIMATIC IPC647E
Update to V25.02.14 or later version
- FixedSIMATIC IPC677E
Update to V25.02.14 or later version
- FixedSIMATIC IPC847E
Update to V25.02.14 or later version
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan