Protection mechanism failure in Intel products - CVE-2024-36242

Vulnerability identifier: #VU101951

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2024-36242

CWE-ID: CWE-693

Exploitation vector: Local access

Exploit availability: No public exploit available

Vendor: Intel

Affected software:
3rd Generation Intel Xeon Scalable Processors
Intel Xeon D Processors
4th Generation Intel Xeon Scalable Processors
4th Generation Intel Xeon Platinum processors
4th Generation Intel Xeon Gold Processors
4th Generation Intel Xeon Silver Processors
4th Generation Intel Xeon Bronze Processors
Intel Xeon CPU Max Series processors (High Bandwidth Memory HBM)
4th Generation Intel Xeon Scalable Processors with Intel vRAN
5th Generation Intel Xeon Scalable processors
4th Generation Intel Xeon Edge Enhanced Processors
Intel Xeon W2400 processor
Intel Xeon W3400 Processor

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insufficient implementation of security measures in the Sub-Page write Permissions (SPP). A local user can execute arbitrary code with elevated privileges.

Install updates from vendor's website.

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01196.html