CVE-2022-21198

MediumCVSS 6.4/10Last modified Aug 11, 2026

Description

Time-of-check time-of-use race condition in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-367

Affected software

No affected versions have been published.

Timeline

Published: Nov 11, 2022
Last modified: Aug 11, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-211995.9An information disclosure vulnerability exists due to the hardcoded TLS key of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted man CVE-2022-21209.8OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write CVE-2022-212018.8A stack-based buffer overflow vulnerability exists in the confers ucloud_add_node_new functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_CVE-2022-212025.5The affected product is vulnerable to an out-of-bounds read, which may result in disclosure of sensitive information.CVE-2022-212037.8Improper permissions in the SafeNet Sentinel driver for Intel(R) Quartus(R) Prime Standard Edition before version 21.1 may allow an authenti CVE-2022-212047.8Improper permissions for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an authenticated user to potentially enable esc CVE-2022-212057.5Improper restriction of XML external entity reference in DSP Builder Pro for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may a CVE-2022-212087.5The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks CVE-2022-212097.8The affected product is vulnerable to an out-of-bounds read while processing project files, which allows an attacker to craft a project file CVE-2022-21216.5OFFIS DCMTK's (All versions prior to 3.6.7) has a NULL pointer dereference vulnerability while processing DICOM files, which may result in a CVE-2022-212108.8An SQL injection vulnerability exists in the AssetActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. A specially-crafted HTTP req CVE-2022-212117.5This affects all versions of package posix. When invoking the toString method, it will fallback to 0x0 value, as the value of toString is no