CVE-2022-26083
Published: 14 February 2025
Summary
CVE-2022-26083 is a high-severity IV (CWE-1204) vulnerability in Intel Integrated Performance Primitives Cryptography. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Weaken Encryption (T1600); ranked at the 31.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2022-26083 affects the Intel(R) IPP Cryptography software library in versions prior to 2021.5, where the generation of weak initialization vectors occurs. This vulnerability, tied to CWE-1204, carries a CVSS v3.1 base score of 7.5 (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) and was published on 2025-02-14.
A local attacker with low privileges can exploit this high-complexity issue without user interaction. Although described as allowing an unauthenticated user via local access, the CVSS metrics indicate low-privilege requirements. Successful exploitation may enable information disclosure with high confidentiality and integrity impacts, along with a changed scope, but no availability disruption.
Intel Security Advisory INTEL-SA-00667 provides details on the vulnerability and mitigation at https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00667.html.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-30651
Vulnerability details
Generation of weak initialization vector in an Intel(R) IPP Cryptography software library before version 2021.5 may allow an unauthenticated user to potentially enable information disclosure via local access.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Weak IV generation directly weakens encryption strength (T1600), enabling subsequent data access or disclosure.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires identification, reporting, and correction of the weak IV generation flaw in Intel IPP Cryptography library versions prior to 2021.5 via timely patching.
Mandates use of approved cryptographic standards and mechanisms that protect confidentiality and integrity, mitigating risks from weak IVs in cryptography libraries.
Requires vulnerability scanning to identify presence of vulnerable Intel IPP Cryptography library versions, enabling proactive remediation.