SB2020111613 - Multiple vulnerabilities in Intel Quartus Prime Pro

Security Bulletin ID SB2020111613

CSH Severity

Low

Patch available

YES

Number of vulnerabilities 2

Exploitation vector Physical access

Highest impact Data manipulation

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 2 vulnerabilities.

1) Buffer overflow (CVE-ID: CVE-2020-8737)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to compromise the target system.

The vulnerability exists due to a boundary error in the Intel Stratix 10 FPGA firmware. An attacker with physical access can trigger memory corruption and enable escalation of privilege or information disclosure.

2) Buffer overflow (CVE-ID: CVE-2020-12312)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to compromise the target system.

The vulnerability exists due to a boundary error in the Intel Stratix 10 FPGA firmware. An attacker with physical access can trigger memory corruption and enable escalation of privilege.

Remediation

Install update from vendor's website.

References

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00388